CVE-2020-15091

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it (**without changing chainID**). A malicious block proposer (even with a minimal amount of stake) can use this vulnerability to completely halt the network. This issue is fixed in Tendermint 0.33.6 which checks all the signatures are for the block with 2/3+ majority before creating a commit.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
tendermint	tendermint	>= 0.33.0, < 0.33.6

References

https://github.com/tendermint/tendermint/commit/480b995a31727593f58b361af979054d17d84340Patch, Third Party Advisory
https://github.com/tendermint/tendermint/issues/4926Exploit, Issue Tracking, Third Party Advisory
https://github.com/tendermint/tendermint/security/advisories/GHSA-6jqj-f58p-mrw3Exploit, Third Party Advisory
https://github.com/tendermint/tendermint/commit/480b995a31727593f58b361af979054d17d84340Patch, Third Party Advisory
https://github.com/tendermint/tendermint/issues/4926Exploit, Issue Tracking, Third Party Advisory
https://github.com/tendermint/tendermint/security/advisories/GHSA-6jqj-f58p-mrw3Exploit, Third Party Advisory

Timeline

Published: Jul 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150924.8In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted cont CVE-2020-150938.6The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an a CVE-2020-150948.8In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class CVE-2020-150954.4Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs lik CVE-2020-150966.8In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the mai CVE-2020-150979.1loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a CVE-2020-150988.8In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been disc CVE-2020-150998.1In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where CVE-2020-15105.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfull CVE-2020-151003.3In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been CVE-2020-151013.3In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion l CVE-2020-151026.5In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configurat