GHSA-82vg-5v4f-f9wq: Namada-apps can Crash with Excessive Computation in Mempool Validation
Impact A malicious transaction may cause a crash in mempool validation. A transaction with authorization section containing 256 public keys or more with valid matching signatures triggers an integer overflow in signature verification that causes a the node to panic. Patches This issue has been patched in apps version 1.1.0. The mempool validation has been fixed to avoid overflow.
Published Feb 20, 2025
Affected packages
namada-apps
- Ecosystem
- Rust (crates.io)
- Affected
- = 1.0.0
- Fixed in
- 1.1.0
- Check
cargo tree -i namada-apps
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
A malicious transaction may cause a crash in mempool validation.
A transaction with authorization section containing 256 public keys or more with valid matching signatures triggers an integer overflow in signature verification that causes a the node to panic.
Patches
This issue has been patched in apps version 1.1.0. The mempool validation has been fixed to avoid overflow.
Workarounds
There are no workarounds and users are advised to upgrade.
Credited to feliam.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology