Skip to content
Fencer Intel
high —

GHSA-j92c-mmf7-j5x5 json

Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd

published 4y ago modified 8mo ago also GO-2022-1066

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact This vulnerability affects IBC transfers due to a security vulnerability dubbed "Dragonberry" upstream in [Cosmos SDK](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.45.9). The vulnerability could allow malicious attackers to compromise chain-to-chain IBC transfers.

There is no vulnerability in the DID/resource modules for cheqd-node.

### Patches Node operators are requested to upgrade to [cheqd-node v0.6.9](https://github.com/cheqd/cheqd-node/releases/tag/0.6.9) as soon as possible. Installation instructions are in the release notes. Please do not install any beta/pre-release versions.

### Workarounds No. The patch takes effect when more than 2/3rds of the voting power of the cheqd network has upgraded to this patch.

An emergency hotfix was released previously under v0.6.8 but this is now deprecated since [Cosmos SDK v0.45.9](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.45.9) officially fixes this upstream.

### References - [IBC Security Advisory on "Dragonberry"](https://forum.cosmos.network/t/ibc-security-advisory-dragonberry/7702/1) (and [associated security vulnerability "Dragonfruit"](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-dragonfruit/7614))

### For more information If you have any questions or comments about this advisory: * Open an issue in [cheqd-node repo](https://github.com/cheqd/cheqd-node/issues) * Email us at [security-github@cheqd.io](mailto:security-github@cheqd.io) * Message us on our community [Slack](http://cheqd.link/join-cheqd-slack) or [Discord](http://cheqd.link/discord-github)

Patch / fix

  • go github.com/cheqd/cheqd-node 0.6.9

Is GHSA-j92c-mmf7-j5x5 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/cheqd/cheqd-node
<0.6.9
0.6.9

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.