Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/microstack-tech/parallax

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GoPublished

    Parallax is vulnerable to DoS via malicious p2p message

    GHSA-xc79-566c-j4qx

    Affected
    • Go github.com/microstack-tech/parallax < 0.1.4
    Fixed in
    0.1.4· Vendor fix available
    Issue
    Impact A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message with a count of 0, using the Parallax protocol. In descendants := chain.GetHeadersFrom(num+count-1, count-1), the value of count-1 is passed to the function GetHeadersFrom(number, count uint64) as parameter count. Due to integer overflow, UINT64MAX value is then passed as the count argument to function GetHeadersFrom(number, count uint64). This allows an attacker to bypass maxHeadersServe and request all headers from the latest block back to the genesis block. Patches The fix has been included in the Parallax client version 0.1.4 and onwards. The vulnerability was patched in: https://github.com/microstack-tech/parallax/commit/f759e9090aaf00a43c616d7cbd133c44bb1ed01e Workarounds No workarounds…

    Recommended action: Upgrade to 0.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →