{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-42448", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-09-08T20:57:45.573Z", "datePublished": "2023-10-04T18:57:52.752Z", "dateUpdated": "2023-10-04T18:57:52.752Z"}, "containers": {"cna": {"title": "Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996"}, {"name": "https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1f", "tags": ["x_refsource_MISC"], "url": "https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1f"}, {"name": "https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03", "tags": ["x_refsource_MISC"], "url": "https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03"}, {"name": "https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296", "tags": ["x_refsource_MISC"], "url": "https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296"}, {"name": "https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323", "tags": ["x_refsource_MISC"], "url": "https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323"}], "affected": [{"vendor": "input-output-hk", "product": "hydra", "versions": [{"version": "< 0.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-04T18:57:52.752Z"}, "descriptions": [{"lang": "en", "value": "Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue."}], "source": {"advisory": "GHSA-mgcx-6p7h-5996", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:iohk:hydra:*:*:*:*:*:*:*:*", "matchCriteriaId": "556BF21B-9F61-4C1D-BD51-A2EC64EA1CE7", "versionEndExcluding": "0.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue."}, {"lang": "es", "value": "Hydra es la soluci\u00f3n de escalabilidad de capa dos para Cardano. Antes de la versi\u00f3n 0.13.0, la especificaci\u00f3n establece que el per\u00edodo de impugnaci\u00f3n en el dato del UTxO en el validador \"head\" debe permanecer sin cambios a medida que el estado avanza de Open a Closed (Transacci\u00f3n cerrada), pero no parece realizarse dicha verificaci\u00f3n en la funci\u00f3n \"checkClose\" del validador \"head\". Esto permitir\u00eda a un participante malintencionado modificar la fecha l\u00edmite de impugnaci\u00f3n del \"head\" para permitirle distribuir el \"head\" sin darle a otro participante la oportunidad de competir, o evitar que cualquier participante redistribuya los fondos bloqueados en el \"head\" a trav\u00e9s de una distribuci\u00f3n. La versi\u00f3n 0.13.0 contiene un parche para este problema."}], "id": "CVE-2023-42448", "lastModified": "2023-10-10T13:07:59.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-10-04T19:15:10.407", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1f"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}