CVE-2018-16733 Go Ethereum Improper Input Validation
An attacker can cause a denial of service in Go Ethereum by providing invalid block ranges to the trace API due to missing validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16733?
CVE-2018-16733 is a high-severity vulnerability in n/a, published on 8 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.
Weakness: CWE-20
Which versions are affected by CVE-2018-16733?
3 open source packages ship an affected version, including github.com/ethereum/go-ethereum. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ethereum/go-ethereum Go | All versions | 1.8.14 |
github.com/ethereum/go-ethereum Go | All versions | 1.8.14 |
github.com/ethereum/go-ethereum Go | All versions | 1.8.14 |
Products include Ethereum Go Ethereum.
How do I fix CVE-2018-16733?
Upgrade github.com/ethereum/go-ethereum to 1.8.14 or later.
Is CVE-2018-16733 being exploited?
There is no known exploitation of CVE-2018-16733 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-26314 Go Ethereum affected by DoS via malicious p2p message
- CVE-2023-42319 go-ethereum vulnerable to denial of service via crafted GraphQL query
- CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum
- CVE-2021-42219 Denial of service in go-ethereum
- CVE-2022-23327 Denial of Service in Go-Ethereum
Sources
Also known as GHSA-qr2j-wrhx-4829, GO-2022-0871.