CVE-2020-12821
First published: Tue Jul 07 2020(Updated: )
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Protocol Gossipsub | =1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bitcoin.stackexchange.com/questions/61151/eclipse-attack-vs-sybil-attack
- https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evaluation%20Report.pdf
- https://github.com/ipfs/blog/pull/450
- https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md
- https://github.com/libp2p/specs/tree/master/pubsub/gossipsub
Frequently Asked Questions
What is the severity of CVE-2020-12821?
CVE-2020-12821 has been classified as a moderate vulnerability due to its potential for enabling eclipse and sybil attacks.
How do I fix CVE-2020-12821?
To mitigate CVE-2020-12821, consider implementing message validation mechanisms and strengthen peer identity verification in Gossipsub 1.0.
What types of attacks are associated with CVE-2020-12821?
CVE-2020-12821 is associated with eclipse attacks and sybil attacks, which exploit weaknesses in the message handling process.
Which version of Gossipsub is affected by CVE-2020-12821?
CVE-2020-12821 specifically affects version 1.0 of the Gossipsub protocol.
Is CVE-2020-12821 a common vulnerability in Gossipsub?
CVE-2020-12821 highlights a significant weakness in Gossipsub 1.0, making it a notable vulnerability in the context of peer-to-peer networking.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- vendor/protocol
- canonical/protocol gossipsub
- version/protocol gossipsub/1.0