DoS via malicious p2p message, upstream CVE-2022-29177

stars-labs / heco-chain

HECO-Chain client based on the go-ethereum fork

GNU Lesser General Public License v3.0

249 stars 141 forks source link

Closed diwu1989 closed 2 years ago

diwu1989 commented 2 years ago

Heco implementation of the p2p disc message deserialization is vulnerable to the same CVE as reported upstream in CVE-2022-29177

The fix is quite simple, please take the time to cherrypick https://github.com/ethereum/go-ethereum/pull/24507

If you are so kind as to provide a bug bounty for this heads up, feel free to donate some tokens to 0xD736B7c9eB18EaE030fA229DD0EC32694De36eA8

Much appreciated and hope you cherrypick the fix.

ken0x4b656e commented 2 years ago

Thanks for your kindly report, we've picked up the fix at #66 .

And I will would like to forward your message to the OP team.