CVE-2019-25072 Uncontrolled resource consumption in github.com/tendermint/tendermint
A malicious server can cause a client to consume excessive resources via Gzip compression and unbounded responses, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25072?
CVE-2019-25072 is a high-severity denial of service vulnerability in github.com/tendermint/tendermint/rpc/lib/client, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
Weakness: CWE-400
Which versions are affected by CVE-2019-25072?
3 open source packages ship an affected version, including github.com/tendermint/tendermint. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tendermint/tendermint Go | All versions | 0.31.1 |
github.com/tendermint/tendermint Go | All versions | 0.31.1 |
github.com/tendermint/tendermint Go | All versions | 0.31.1 |
Products include Tendermint Tendermint.
How do I fix CVE-2019-25072?
Upgrade github.com/tendermint/tendermint to 0.31.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-25072 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25072 exists.
Other vulnerabilities in github.com/tendermint/tendermint/rpc/lib/client
Sources
Also known as GHSA-3fm3-m23v-5r46, GO-2020-0037.