What is GHSA-qf7j-25g9-r63f?

GHSA-qf7j-25g9-r63f is a security advisory published by GitHub Security Advisories with High severity. elrond-go MultiESDTNFTTransfer call on a SC address with missing function name

Which CVE IDs does GHSA-qf7j-25g9-r63f cover?

GHSA-qf7j-25g9-r63f covers the following CVE IDs: CVE-2022-36058. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qf7j-25g9-r63f?

GHSA-qf7j-25g9-r63f has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qf7j-25g9-r63f?

GHSA-qf7j-25g9-r63f affects 1 product, including: go/github.com/ElrondNetwork/elrond-go:\u003c= 1.3.33.

GHSA-qf7j-25g9-r63fHighCVSS 7.5

elrond-go MultiESDTNFTTransfer call on a SC address with missing function name

Vendor

GitHub Security Advisories

Published

September 1, 2022

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-36058 →

📋 Description

Impact

Anyone who uses elrond-go to process blocks (historical or actual) that contains a transaction like this: MultiESDTNFTTransfer@01@54444558544b4b5955532d323631626138@00@0793afc18c8da2ca@ (mind the missing function name after the last @) Basic functionality like p2p messaging, storage, API requests and such are unaffected.

Patches

Patch v1.3.34 or higher

Workarounds

No workarounds

References

For future reference, one can observe the following integration test: [provide the link to the integration test]

For more information

If you have any questions or comments about this advisory:

Open an issue in elrond-go (http://github.com/ElrondNetwork/elrond-go/issues)

🎯 Affected products1

go/github.com/ElrondNetwork/elrond-go:<= 1.3.33