CVE-2023-34458
High
Description
mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.
SeverityHigh
CVSS7.1
Exploit probability—
ProductMultiversx Mx-chain-go
PublishedJul 13, 2023
First seenJul 13, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- multiversx mx-chain-go1.4.17 or later
- github.com/multiversx/mx-chain-go1.4.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| multiversx mx-chain-go | v < 1.4.17 | 1.4.17 |
| github.com/multiversx/mx-chain-goGo | v < 1.4.17 | 1.4.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.