CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2020-26240
High (7.5) in ethereum go ethereum. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in github.com/ethereum/go-ethereum 1.9.24.
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-682
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ethereum:go_ethereum
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v592-xf75-856p | Go | github.com/ethereum/go-ethereum | <1.9.24 | 1.9.24 |
| GO-2022-0775 | Go | github.com/ethereum/go-ethereum | <1.9.24 | 1.9.24 |
References
- https://blog.ethereum.org/2020/11/12/geth_security_release/
- https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0
- https://github.com/ethereum/go-ethereum/pull/21793
- https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p
- https://blog.ethereum.org/2020/11/12/geth_security_release/