CVE-2020-5303

CVSS V2 Medium 4.3 CVSS V3 Low 3.7
Description
Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P connection requests. For each p2p connection, it allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Additionally, Tendermint does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting above denial of service), which ultimately will lead to the node panicking. These issues are patched in Tendermint 0.33.3 and 0.32.10.
Overview
  • CVE ID
  • CVE-2020-5303
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2020-04-10T19:15:13
  • Last Modified Date
  • 2020-06-30T18:15:12
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:tendermint:tendermint:*:*:*:*:*:*:*:* 1 OR 0.31.12
cpe:2.3:a:tendermint:tendermint:*:*:*:*:*:*:*:* 1 OR 0.32.0 0.32.10
cpe:2.3:a:tendermint:tendermint:*:*:*:*:*:*:*:* 1 OR 0.33.0 0.33.3
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • HIGH
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • LOW
  • Base Score
  • 3.7
  • Base Severity
  • LOW
  • Exploitability Score
  • 2.2
  • Impact Score
  • 1.4
History
Created Old Value New Value Data Type Notes
2022-05-10 16:41:45 Added to TrackCVE
2022-12-04 14:17:59 2020-04-10T19:15Z 2020-04-10T19:15:13 CVE Published Date updated
2022-12-04 14:17:59 2020-06-30T18:15:12 CVE Modified Date updated
2022-12-04 14:17:59 Modified Vulnerability Status updated