CVE-2021-21271
Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
Description
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be asked to generate a new evidence. This new evidence will be the same, which means it will again be rejected by other nodes involved in the consensus. This loop will continue until the peer nodes decide to disconnect from the node producing the evidence.
How to fix CVE-2021-21271
To remediate CVE-2021-21271, upgrade the affected package to a fixed version below.
- —upgrade to 0.34.3 or later
- —upgrade to 0.34.3 or later
Is CVE-2021-21271 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 0.34.0, < 0.34.3
- >= 0.34.0, < 0.34.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |