{"id":"GHSA-7fw6-6mfj-g3q2","aliases":[],"status":"published","title":"ckb: Transaction header_deps validation issue (network forking)","description":"### Impact\nfn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176\n\nIt will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.\n\n### Patches\n\n0.101.1 and later versions","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-11-02T18:14:30Z","modified":"2023-01-08T05:03:15Z","fixes":[{"ecosystem":"crates.io","package":"ckb","fixed_in":["0.101.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ckb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.101.0"},{"fixed":"0.101.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ckb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.101.1"}]}]}],"references":[{"url":"https://github.com/nervosnetwork/ckb/security/advisories/GHSA-7fw6-6mfj-g3q2","tags":["web"]},{"url":"https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7fw6-6mfj-g3q2"},{"url":"https://github.com/nervosnetwork/ckb","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-7fw6-6mfj-g3q2","title":"ckb: Transaction header_deps validation issue (network forking)","description":"### Impact\nfn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176\n\nIt will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.\n\n### Patches\n\n0.101.1 and later versions","status":"published","published":"2022-11-02T18:14:30Z","modified":"2023-01-08T05:03:15Z","updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-7fw6-6mfj-g3q2","title":"ckb: Transaction header_deps validation issue (network forking)","description":"### Impact\nfn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176\n\nIt will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.\n\n### Patches\n\n0.101.1 and later versions","status":"published","published":"2022-11-02T18:14:30Z","modified":"2022-11-02T18:14:30Z","updated_at":"2026-11-02T15:46:41.002603Z"}]}}