id: GO-2024-2831
modules:
    - module: github.com/spacemeshos/api/release/go
      versions:
        - fixed: 1.37.1
      vulnerable_at: 1.37.0
      packages:
        - package: github.com/spacemeshos/api/release/go/spacemesh/v1
    - module: github.com/spacemeshos/go-spacemesh
      versions:
        - fixed: 1.5.2-hotfix1
      vulnerable_at: 1.5.1
      packages:
        - package: github.com/spacemeshos/go-spacemesh/activation
          symbols:
            - Handler.HandleGossipAtx
            - Handler.storeAtx
            - Handler.SyntacticallyValidateDeps
            - Handler.processATX
          skip_fix: 'Nonstandard cgo library: github.com/spacemeshos/post@v0.12.6/internal/postrs/api.go'
        - package: github.com/spacemeshos/go-spacemesh/events
          symbols:
            - ToMalfeasancePB
          derived_symbols:
            - CloseEventReporter
            - EmitAtxPublished
            - EmitBeacon
            - EmitEligibilities
            - EmitInitComplete
            - EmitInitFailure
            - EmitInitStart
            - EmitInvalidPostProof
            - EmitOwnMalfeasanceProof
            - EmitPoetWaitProof
            - EmitPoetWaitRound
            - EmitPostComplete
            - EmitPostFailure
            - EmitPostServiceStarted
            - EmitPostServiceStopped
            - EmitPostStart
            - EmitProposal
            - InitializeReporter
            - LayerUpdate.Field
            - ReportAccountUpdate
            - ReportError
            - ReportLayerUpdate
            - ReportMalfeasance
            - ReportNewActivation
            - ReportNewTx
            - ReportNodeStatusUpdate
            - ReportProposal
            - ReportResult
            - ReportRewardReceived
            - ReportTxWithValidity
            - SubcribeProposals
            - Subscribe
            - SubscribeAccount
            - SubscribeActivations
            - SubscribeErrors
            - SubscribeLayers
            - SubscribeMalfeasance
            - SubscribeMatched
            - SubscribeRewards
            - SubscribeStatus
            - SubscribeToLayers
            - SubscribeTxs
            - SubscribeUserEvents
        - package: github.com/spacemeshos/go-spacemesh/malfeasance
          symbols:
            - Validate
            - Handler.HandleSyncedMalfeasanceProof
          skip_fix: 'Nonstandard cgo library: github.com/spacemeshos/post@v0.12.6/internal/postrs/api.go'
        - package: github.com/spacemeshos/go-spacemesh/malfeasance/wire
          symbols:
            - MalfeasanceInfo
            - MalfeasanceProof.MarshalLogObject
            - Proof.DecodeScale
          derived_symbols:
            - AtxProof.DecodeScale
            - AtxProof.MarshalLogObject
            - AtxProofMsg.DecodeScale
            - AtxProofMsg.SignedBytes
            - BallotProof.DecodeScale
            - BallotProof.MarshalLogObject
            - BallotProofMsg.DecodeScale
            - BallotProofMsg.SignedBytes
            - HareMetadata.DecodeScale
            - HareMetadata.ToBytes
            - HareProof.DecodeScale
            - HareProof.MarshalLogObject
            - HareProofMsg.DecodeScale
            - HareProofMsg.SignedBytes
            - InvalidPostIndexProof.DecodeScale
            - InvalidPostIndexProof.EncodeScale
            - MalfeasanceGossip.DecodeScale
            - MalfeasanceGossip.EncodeScale
            - MalfeasanceProof.DecodeScale
            - MalfeasanceProof.EncodeScale
            - Proof.EncodeScale
        - package: github.com/spacemeshos/go-spacemesh/node
          symbols:
            - App.setupDBs
            - App.verifyDB
          skip_fix: 'Nonstandard cgo library: github.com/spacemeshos/post@v0.12.6/internal/postrs/api.go'
        - package: github.com/spacemeshos/go-spacemesh/sql/atxs
          symbols:
            - AddGettingNonce
            - IterateIDsByEpoch
          derived_symbols:
            - Add
summary: ATX protocol validation problem in github.com/spacemeshos/go-spacemesh
description: |-
    Nodes can publish ATXs which reference the incorrect previous ATX of
    the Smesher that created the ATX. ATXs are expected to form a single chain from
    the newest to the first ATX ever published by an identity. Allowing Smeshers to
    reference an earlier (but not the latest) ATX as previous breaks this protocol
    rule.
cves:
    - CVE-2024-34360
ghsas:
    - GHSA-jcqq-g64v-gcm7
references:
    - advisory: https://github.com/spacemeshos/go-spacemesh/security/advisories/GHSA-jcqq-g64v-gcm7
    - fix: https://github.com/spacemeshos/api/commit/1d5bd972bbe225d024c3e0ae5214ddb6b481716e
    - fix: https://github.com/spacemeshos/go-spacemesh/commit/9aff88d54be809ac43d60e8a8b4d65359c356b87
    - web: https://spacemesh.io/blog/spacemesh-white-paper-1
source:
    id: GHSA-jcqq-g64v-gcm7
    created: 2024-05-11T21:02:32.457027-07:00