cve.bz

CVE-2020-15091

6.5 mediumEPSS 0.9%

Medium (6.5) in tendermint tendermint. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in github.com/tendermint/tendermint 0.33.6, 0.34.0-dev1.0.20200702134149-480b995a3172.

TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it (**without changing chainID**). A malicious block proposer (even with a minimal amount of stake) can use this vulnerability to completely halt the network. This issue is fixed in Tendermint 0.33.6 which checks all the signatures are for the block with 2/3+ majority before creating a commit.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE
CWE-347
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6jqj-f58p-mrw3Gogithub.com/tendermint/tendermint<0.33.60.33.6
GO-2021-0090Gogithub.com/tendermint/tendermint>=0.33.0 <0.34.0-dev1.0.20200702134149-480b995a31720.34.0-dev1.0.20200702134149-480b995a3172

References

Check your stackJSON