Geth v1.10.8 is a pre-announced hotfix release to patch a vulnerability in the EVM (CVE-2021-39137).
The exact attack vector will be provided at a later date to give node operators and dependent downstream projects time to update their nodes and software. All Geth versions supporting the London hard fork are vulnerable (the bug is older than London), so all users should update.
Credits for the discovery go to @guidovranken (working for Sentnl during an audit of the Telos EVM) and reported via bounty@ethereum.org.
Beside the fix, we're merged in a few tiny polishes and fixes. For a rundown, please consult the Geth 1.10.8 release milestone.
As with all our previous releases, you can find the:
- Pre-built binaries for all platforms on our downloads page.
- Docker images published under
ethereum/client-go. - Ubuntu packages in our Launchpad PPA repository.
- OSX packages in our Homebrew Tap repository.