Detections
Analytics
SCA: security update for github.com/cometbft/cometbft (GHSA-w24w-wp77-qffm)
high Tenable Self-Hosted Container Security Plugin ID 419625
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and
replicates it on many machines. The mempool maintains two data structures to keep track of outstanding
transactions: a list and a map. These two data structures are supposed to be in sync all the time in the
sense that the map tracks the index (if any) of the transaction in the list. In `v0.37.0`, and `v0.37.1`,
as well as in `v0.34.28`, and all previous releases of the CometBFT repo2, it is possible to have them out
of sync. When this happens, the list may contain several copies of the same transaction. Because the map
tracks a single index, it is then no longer possible to remove all the copies of the transaction from the
list. This happens even if the duplicated transaction is later committed in a block. The only way to
remove the transaction is by restarting the node. The above problem can be repeated on and on until a
sizable number of transactions are stuck in the mempool, in order to try to bring down the target node.
The problem is fixed in releases `v0.34.29` and `v0.37.2`. Some workarounds are available. Increasing the
value of `cache_size` in `config.toml` makes it very difficult to effectively attack a full node. Not
exposing the transaction submission RPC's would mitigate the probability of a successful attack, as the
attacker would then have to create a modified (byzantine) full node to be able to perform the attack via
p2p. (CVE-2023-34451)
See Also
Plugin Details
Severity: High
ID: 419625
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.5
Percentile: 51.91
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C
CVSS Score Source: CVE-2023-34451
CVSS v3
Risk Factor: High
Base Score: 8.2
Temporal Score: 7.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/5/2023
Vulnerability Publication Date: 7/3/2023
Reference Information
CVE: CVE-2023-34451
cwe: CWE-401