Open-source package vulnerability · Rust (crates.io)
GHSA-q73f-w3h7-7wcc: Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result
critical
Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none.
Published Feb 3, 2024
Affected packages
ckb
- Ecosystem
- Rust (crates.io)
- Affected
- <= 0.34.1
- Fixed in
- 0.34.2
- Check
cargo tree -i ckb
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Tx-pool verify transaction which inputs' script contains load_cell_data_hash is nondeterministic
Workarounds
Enforce tx-pool ResolvedTrascation inputs' load data is none.
References
- https://github.com/nervosnetwork/ckb/security/advisories/GHSA-q73f-w3h7-7wcc
- https://github.com/nervosnetwork/ckb/commit/01eb5b2ecadf7e421b117d6c013e182978746e2f
- https://github.com/nervosnetwork/ckb/commit/fe83220905599e72c97878295f4769e91348d738
- https://github.com/nervosnetwork/ckb/commit/ff88b48779358e038209f3ac1bc1061e6f4deb13
- https://github.com/advisories/GHSA-q73f-w3h7-7wcc
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology