Detections
Analytics
SCA: security update for github.com/ElrondNetwork/elrond-go (GHSA-p228-4mrh-ww7r)
medium Tenable Cloud Security Plugin ID 417203
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to
a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with
a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches
and the processing component. If the above-mentioned transaction was sent with more gas than required, the
smart contract result (SCR transaction) that should have returned the leftover gas, would have been
wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain
blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found
in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been
patched in version 1.3.50. (CVE-2022-46173)
See Also
Plugin Details
Severity: Medium
ID: 417203
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.1
Percentile: 6.91
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P
CVSS Score Source: CVE-2022-46173
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 12/30/2022
Vulnerability Publication Date: 12/28/2022
Reference Information
CVE: CVE-2022-46173
cwe: CWE-669