Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-26240

Good to know:

icon

Date: November 24, 2020

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24

Language: Go

Severity Score

Related Resources (7)

https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p
https://nvd.nist.gov/vuln/detail/CVE-2020-26240
https://blog.ethereum.org/2020/11/12/geth_security_release
https://github.com/ethereum/go-ethereum/pull/21793
https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0
https://blog.ethereum.org/2020/11/12/geth_security_release/
https://www.mend.io/vulnerability-database/CVE-2020-26240

Severity Score

Weakness Type (CWE)

Incorrect Calculation

CWE-682

Top Fix

icon

Upgrade Version

Upgrade to version v1.9.24

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us