| ID |
CVE-2023-42806
|
| Sažetak |
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finalize because the value available is not consistent with the closed utxo state (= denial of service; easy). A patch is planned for version 0.13.0. As a workaround, rotate keys between heads so not to re-use keys and not result in the same multi-signature participants. |
| Reference |
|
| CVSS |
| Base: | 6.5 |
| Impact: | 5.2 |
| Exploitability: | 1.2 |
|
| Pristup |
| Vektor | Složenost | Autentikacija |
| NETWORK |
LOW |
- |
|
| Impact |
| Povjerljivost | Cjelovitost | Dostupnost |
| NONE |
HIGH |
HIGH |
|
| CVSS vektor |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| Zadnje važnije ažuriranje |
26-09-2023 - 14:41 |
| Objavljeno |
21-09-2023 - 17:15 |
