PT-2025-7650 · Cosmossdk · Cosmossdk

Published 2025-02-20 · Updated 2025-02-20

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CosmosSDK versions <= 0.47.15 CosmosSDK versions <= 0.50.11

Description An issue was discovered in the groups module where a malicious proposal would result in a division by zero, and subsequently halt a chain due to the resulting error. Any user that can interact with the groups module can introduce this state.

Recommendations For CosmosSDK versions <= 0.47.15, update to version 0.47.16 to fix the issue. For CosmosSDK versions <= 0.50.11, update to version 0.50.12 to fix the issue.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

GHSA-X5VX-95H7-RV4P

Affected Products

Cosmossdk

References · 6

• https://osv.dev/vulnerability/GHSA-x5vx-95h7-rv4p · Vendor Advisory
• https://github.com/cosmos/cosmos-sdk · Note
• https://github.com/cosmos/cosmos-sdk/commit/0a98b65b24900a0e608866c78f172cf8e4140aea · Note
• https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-x5vx-95h7-rv4p · Note
• https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.16 · Note
• https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.12 · Note