{"id":"GHSA-7fw6-6mfj-g3q2","aliases":[],"url":"https://o3.security/vulnerability/GHSA-7fw6-6mfj-g3q2","summary":"ckb: Transaction header_deps validation issue (network forking)","details":"### Impact\nfn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176\n\nIt will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.\n\n### Patches\n\n0.101.1 and later versions","published":"2022-11-02T18:14:30Z","modified":"2022-11-02T18:14:30Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"ckb","fixedVersion":"0.101.1"}],"fix":{"url":"https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176","label":"nervosnetwork/ckb#1646"},"references":[{"type":"WEB","url":"https://github.com/nervosnetwork/ckb/security/advisories/GHSA-7fw6-6mfj-g3q2"},{"type":"WEB","url":"https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176"},{"type":"PACKAGE","url":"https://github.com/nervosnetwork/ckb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2022-11-02T18:14:30Z"}}