NVD Vulnerability Detail

CVE-2020-12821

Summary	Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
Publication Date	July 8, 2020, 5:15 a.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 2 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:protocol:gossipsub:1.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bitcoin.stackexchange.com/questions/61151/eclipse-attack-vs-sybil-attack	Third Party Advisory
2	https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evaluation%20Report.pdf	Exploit Vendor Advisory
3	https://github.com/ipfs/blog/pull/450	Patch Third Party Advisory
4	https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md	Third Party Advisory
5	https://github.com/libp2p/specs/tree/master/pubsub/gossipsub	Third Party Advisory
6	https://bitcoin.stackexchange.com/questions/61151/eclipse-attack-vs-sybil-attack	Third Party Advisory
7	https://github.com/libp2p/specs/tree/master/pubsub/gossipsub	Third Party Advisory
8	https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md	Third Party Advisory
9	https://github.com/ipfs/blog/pull/450	Patch Third Party Advisory
10	https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evaluation%20Report.pdf	Exploit Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Gossipsub における脆弱性

Title	Gossipsub における脆弱性
Summary	Gossipsub には、不特定の脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 8, 2020, midnight
Registration Date	Aug. 25, 2020, 4:30 p.m.
Last Update	Aug. 25, 2020, 4:30 p.m.

Affected System

libp2p

Gossipsub 1.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-12821	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12821
National Vulnerability Database (NVD)
2	CVE-2020-12821	https://nvd.nist.gov/vuln/detail/CVE-2020-12821

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
GitHub
1	gossipsub v1.1: Security extensions to improve on attack resilience and bootstrapping	https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md
2	gossipsub: An extensible baseline pubsub protocol	https://github.com/libp2p/specs/tree/master/pubsub/gossipsub

その他

No	Name	URL
関連文書
1	Create 102-gossipsub-reports.md #450	https://github.com/ipfs/blog/pull/450

Change Log

No	Changed Details	Date of change
1	[2020年08月25日] 掲載	Aug. 25, 2020, 4:30 p.m.