CVE-2020-26240 – github.com/ethereum/go-ethereum

Package

Manager: go
Name: github.com/ethereum/go-ethereum
Vulnerable Version: >=0 <1.9.24

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00269 pctl0.50044

Details

Erroneous Proof of Work calculation in geth ### Impact An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. ### Patches This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix. ### Workarounds This PR implements a patch: https://github.com/ethereum/go-ethereum/pull/21793 ### References https://blog.ethereum.org/2020/11/12/geth_security_release/ ### For more information If you have any questions or comments about this advisory: * Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum) * Email us at [security@ethereum.org](mailto:security@ethereum.org)

Metadata

Created: 2021-06-29T21:12:56Z
Modified: 2025-01-30T14:39:18Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-v592-xf75-856p/GHSA-v592-xf75-856p.json
CWE IDs: ["CWE-682"]
Alternative ID: GHSA-v592-xf75-856p
Finding: F138
Auto approve: 1