CVE-2021-43668

[vtermanis]

CVE-2021-43668 (in github.com/ethereum/go-ethereum)

iotics-identity-go library uses go-ethereum but only a very small set of library functions from it, namely:

• go-ethereum/crypto.UnmarshalPubkey() (code)
• go-ethereum/crypto.FromECDSAPub() (code)
• go-ethereum/crypto/secp256k1.BitCurve (tests only)

The aforementioned CVE affects only go-ethereum's geth executable and its use of github.com/syndtr/goleveldb .

Because of this, iotics-identity-go is not affected by this security issue:

$ go mod why -m github.com/ethereum/go-ethereum
# github.com/ethereum/go-ethereum
github.com/Iotic-Labs/iotics-identity-go/pkg/crypto
github.com/ethereum/go-ethereum/crypto

$ go mod why -m github.com/syndtr/goleveldb
# github.com/syndtr/goleveldb
(main module does not need module github.com/syndtr/goleveldb)

Ticket references

• Nodes crash down after receiving a serial of messages generated by fuzzer, and cannot be recovered ethereum/go-ethereum#23866
• Nil pointer in leveldb syndtr/goleveldb#373