Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26252 State: PUBLISHED Published: 2021-01-20T21:55:13 Last Updated: 2024-08-04T15:56:03.990Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-22, CWE-434 Description: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved. Additional Analyst Notes: - C
ayout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-99m6-r53j-4hh2 - https://github.com/OpenMage/magento-lts/commit/0786aa48bc7b618cfe37b59f45e1da3714c533c3
CVE ID: CVE-2020-26253 State: PUBLISHED Published: 2020-12-08T01:15:14 Last Updated: 2024-08-04T15:56:04.401Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: getkirby Products: kirby Problem Types: CWE-346 Description: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that
stration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk. To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with t
l users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. This installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site. Additionally the local installation check may also fail if your site is behind a reverse proxy. You are only affected if you use a .dev domain or your site is behind a reverse proxy and you have not yet registered your first Panel accoun
if you use a .dev domain or your site is behind a reverse proxy and you have not yet registered your first Panel account on the public server and someone finds your site and tries to login at `yourdomain.dev/panel` before you register your first account. You are not affected if you have already created one or multiple Panel accounts (no matter if on a .dev domain or behind a reverse proxy). The problem has been patched in Kirby 3.3.6. Please upgrade to this or a later version to fix the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/getkirby/kirby/security/advisories/GHSA-2ccx-2gf3-8xvv - https://github.com/getkirby-v2/panel/commit/7f9ac18
/github.com/getkirby/kirby/security/advisories/GHSA-2ccx-2gf3-8xvv - https://github.com/getkirby-v2/panel/commit/7f9ac1876bacb89fd8f142f5e561a02ebb725baa - https://github.com/getkirby/kirby/releases/tag/3.3.6 - https://packagist.org/packages/getkirby/cms - https://packagist.org/packages/getkirby/panel
CVE ID: CVE-2020-26254 State: PUBLISHED Published: 2020-12-08T14:20:13 Last Updated: 2024-08-04T15:56:03.550Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: nhosoya Products: omniauth-apple Problem Types: CWE-290 Description: omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth's Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's cho
s Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's choice including email addresses of other users. Applications not using info.email for identification but are instead using the uid field are not impacted in the same manner. Note, these applications may still be negatively affected if the value of info.email is being used for other purposes. Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633 - https://github.com/n
: References: - https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633 - https://github.com/nhosoya/omniauth-apple/commit/b37d5409213adae2ca06a67fec14c8d3d07d9016 - https://github.com/nhosoya/omniauth-apple/blob/master/CHANGELOG.md#101---2020-12-03
CVE ID: CVE-2020-26255 State: PUBLISHED Published: 2020-12-08T14:45:20 Last Updated: 2024-08-04T15:56:03.743Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: getkirby Products: kirby Problem Types: CWE-434 Description: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector.
hey can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14. Additional Analyst Notes: - CVE Program Container: References: - https://packagist.org/packages/getkirby/cms - https://packagist.org/packages/getkirby/panel - https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw - https://github.com
packages/getkirby/panel - https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw - https://github.com/getkirby/kirby/releases/tag/3.4.5 - https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09 - https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881
CVE ID: CVE-2020-26256 State: PUBLISHED Published: 2020-12-08T21:45:19 Last Updated: 2024-08-04T15:56:03.099Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: C2FO Products: fast-csv Problem Types: CWE-400 Description: Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest ve
you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/C2FO/fast-csv/security/advisories/GHSA-8cv5-p934-3hwp - https://lgtm.com/query/8609731774537641779/ - https://github.com/C2FO/fast-csv/issues/540 - https://github.com/C2FO/fast-csv/commit/4bbd39f26a8cd7382151ab4f5fb102234b2f829e - https://www.npmjs.com/package/%40fast-csv/parse - https://www.npmjs.com/package/fast-csv
CVE ID: CVE-2020-26257 State: PUBLISHED Published: 2020-12-09T18:25:15 Last Updated: 2024-08-04T15:56:03.561Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: matrix-org Products: synapse Problem Types: CWE-400, CWE-79 Description: Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sen
hange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm - https:/
Program Container: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm - https://github.com/matrix-org/synapse/pull/8776 - https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b - https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC/
CVE ID: CVE-2020-26258 State: PUBLISHED Published: 2020-12-16T01:05:22 Last Updated: 2025-01-15T20:20:17.971Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-918 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at
he processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/
ailed in the referenced advisories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28 - https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7 - https://lists.fedoraproject.org/archives/list/package-announce@
raproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB - https://security.netapp.com/advisory/ntap-20210409-0005 - https://www.debian.org/security/2021/dsa-4828 - https://x-stream.github.io/CVE-2020-26258.html
CVE ID: CVE-2020-26259 State: PUBLISHED Published: 2020-12-16T01:05:16 Last Updated: 2024-08-04T15:56:04.167Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-78 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework
ts only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories. Additional Analyst Notes: - CVE Program Container: References
d described in more detailed in the referenced advisories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh - https://x-stream.github.io/CVE-2020-26259.html - https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html - https://www.debian.org/security/2021/dsa-4828 - https://security.netapp.com/advisory/ntap-20210409-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://l
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
CVE ID: CVE-2020-26260 State: PUBLISHED Published: 2020-12-09T16:20:14 Last Updated: 2024-08-04T15:56:04.938Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: BookStackApp Products: BookStack Problem Types: CWE-74 Description: BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wider scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaro
r scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BookStackApp/BookStack/security/advisories/GHSA-8wfc-w2r5-x7cr - https://bookstackapp.com/blog/beta-release-v0-30-5/ - https://github.com/BookStackApp/BookStack/releases/tag/v0.30.5
CVE ID: CVE-2020-26261 State: PUBLISHED Published: 2020-12-09T16:30:14 Last Updated: 2024-08-04T15:56:03.813Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: jupyterhub Products: systemdspawner Problem Types: CWE-668 Description: jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
ittlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6 - https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580 - https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015 - https://pypi.org/project/jupyterhub-systemdspawner/
CVE ID: CVE-2020-26262 State: PUBLISHED Published: 2021-01-13T18:15:17 Last Updated: 2024-08-04T15:56:03.733Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: coturn Products: coturn Problem Types: CWE-441, CWE-682 Description: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is a
uccessful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patche
opback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p - https://github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4d - https://github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog#L48 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr
3537e69ae8cb8aefd8f3f546/ChangeLog#L48 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G54UIUFTEC6RLPOISMB6FUW7456SBZC4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4CJOPAQT43MYAFU3UROGLEXN3Z6RS4H/
CVE ID: CVE-2020-26263 State: PUBLISHED Published: 2020-12-21T16:55:18 Last Updated: 2024-08-04T15:56:03.863Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: tlsfuzzer Products: tlslite-ng Problem Types: CWE-326 Description: tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that
n about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tlsfuzzer/tlslite-ng/security/advisories
tional Analyst Notes: - CVE Program Container: References: - https://github.com/tlsfuzzer/tlslite-ng/security/advisories/GHSA-wvcv-832q-fjg7 - https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/ - https://github.com/tlsfuzzer/tlslite-ng/pull/438 - https://github.com/tlsfuzzer/tlslite-ng/pull/439 - https://pypi.org/project/tlslite-ng/ - https://github.com/tlsfuzzer/tlslite-ng/commit/c28d6d387bba59d8bd5cb3ba15edc42edf54b368
CVE ID: CVE-2020-26264 State: PUBLISHED Published: 2020-12-11T16:45:24 Last Updated: 2024-08-04T15:56:04.248Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ethereum Products: go-ethereum Problem Types: CWE-400 Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25. Additional Analyst Notes: - CVE Program Co
ng les prevents the exploit. The vulnerability was patched in version 1.9.25. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-r33q-22hv-j29q - https://github.com/ethereum/go-ethereum/pull/21896 - https://github.com/ethereum/go-ethereum/commit/bddd103a9f0af27ef533f04e06ea429cf76b6d46 - https://github.com/ethereum/go-ethereum/releases/tag/v1.9.25
CVE ID: CVE-2020-26265 State: PUBLISHED Published: 2020-12-11T16:45:15 Last Updated: 2024-08-04T15:56:03.493Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: ethereum Products: go-ethereum Problem Types: CWE-682 Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where vulnerable versions refuse to accept the canonical chain. The fix was included in the Paragade release version 1.9.20. No individual workaround patches have been made -- all users are recommended to upgrade to a newer version. Additional Ana