-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-7pq9-rf9p-wcrf, is a caching issue within the go-f3 library's justification verification process. The root cause is that the caching mechanism for validation results did not properly account for the message context.
The function cachingValidator.validateJustification in gpbft/validator.go was using a cache key for justifications that was generated only from the content of the justification itself. The cachingValidator.getCacheKey function was responsible for this behavior. Consequently, if a justification was validated once in a correct context, its validation result would be cached. An attacker could then reuse this same justification in a different, invalid context (e.g., for a different message value). The system would find the cached result based on the justification's hash and incorrectly skip the full validation, leading to the acceptance of an invalid message.
The patch addresses this by making the cache key more specific. It modifies cachingValidator.getCacheKey to accept additional data. The cachingValidator.validateJustification function is updated to pass the expectedVoteValueKey (a key derived from the value being voted on in the message) to getCacheKey. This ensures that the cache key is now a composite of the justification and the context in which it is used, effectively preventing the reuse of cached validations across different contexts and closing the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/filecoin-project/go-f3 | go | < 0.8.9 | 0.8.9 |
GoGoOngoing coverage of React2Shell