GHSA-q73f-w3h7-7wcc json
Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result
published 2y ago modified 2y ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Impact Tx-pool verify transaction which inputs' script contains `load_cell_data_hash` is nondeterministic
### Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none.
Patch / fix
- crates.io ckb 0.34.2
Is GHSA-q73f-w3h7-7wcc in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | ckb | <0.34.2 |
0.34.2 |
References
-
github.com
/nervosnetwork/ckb/commit/01eb5b2ecadf7e421b117d6c013e182978746e2f
web
-
github.com
/nervosnetwork/ckb/commit/fe83220905599e72c97878295f4769e91348d738
web
-
github.com
/nervosnetwork/ckb/commit/ff88b48779358e038209f3ac1bc1061e6f4deb13
web
-
github.com
/nervosnetwork/ckb/security/advisories/GHSA-q73f-w3h7-7wcc
web
Sources
- GitHub Advisory GHSA-q73f-w3h7-7wcc
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.