PT-2023-32998 · Unknown · Cheqd-Node+1

Publicado 2023-06-12 · Atualizado 2023-06-12

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions cheqd-node versions prior to 1.4.4 Cosmos SDK versions prior to 0.46.13

Description The issue affects the Cosmos SDK framework, specifically how it handles vesting accounts, making it a high-impact vulnerability for networks using the framework. There is no vulnerability in the DID/resource modules for cheqd-node. The estimated number of potentially affected devices is not specified.

Recommendations For cheqd-node versions prior to 1.4.4, upgrade to cheqd-node v1.4.4. For Cosmos SDK versions prior to 0.46.13, upgrade to Cosmos SDK v0.46.13 or apply the backported fix to cheqd's fork of Cosmos SDK, version v0.46.10-barberry. As a temporary workaround, consider waiting until at least ~33% of the voting power of the network has deployed the recommended version of the software to minimize the risk of a successful attack causing a chain halt.

Identificadores relacionados

GHSA-8QXH-2GH8-R923

Produtos afetados

Cosmossdk

Cheqd-Node

Referências · 5

• https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13 · Nota
• https://github.com/cheqd/cheqd-node · Nota
• https://github.com/cheqd/cheqd-node/security/advisories/GHSA-8qxh-2gh8-r923 · Nota
• https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825 · Nota
• https://osv.dev/vulnerability/GHSA-8qxh-2gh8-r923 · Aviso do Fabricante