PT-2023-32998 · Unknown · Cheqd-Node+1

Published 2023-06-12 · Updated 2023-06-12

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions cheqd-node versions prior to 1.4.4 Cosmos SDK versions prior to 0.46.13

Description The issue affects the Cosmos SDK framework, specifically how it handles vesting accounts, making it a high-impact vulnerability for networks using the framework. There is no vulnerability in the DID/resource modules for cheqd-node. The estimated number of potentially affected devices is not specified.

Recommendations For cheqd-node versions prior to 1.4.4, upgrade to cheqd-node v1.4.4. For Cosmos SDK versions prior to 0.46.13, upgrade to Cosmos SDK v0.46.13 or apply the backported fix to cheqd's fork of Cosmos SDK, version v0.46.10-barberry. As a temporary workaround, consider waiting until at least ~33% of the voting power of the network has deployed the recommended version of the software to minimize the risk of a successful attack causing a chain halt.

Related Identifiers

GHSA-8QXH-2GH8-R923

Affected Products

Cosmossdk

Cheqd-Node

References · 5

• https://osv.dev/vulnerability/GHSA-8qxh-2gh8-r923 · Vendor Advisory
• https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13 · Note
• https://github.com/cheqd/cheqd-node · Note
• https://github.com/cheqd/cheqd-node/security/advisories/GHSA-8qxh-2gh8-r923 · Note
• https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825 · Note