Description
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | < 11.0.0 | 11.0.0 |
References
- GitHub Security Advisory (GHSA-x6v8-c2xp-928m) vendor-advisory
- VulnCheck Advisory: Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 third-party-advisory