Skip to content
Fencer Intel
high —

GHSA-w6rp-vxj2-fjhr json

Cosmos packet-forward-middleware vulnerable to chain-halt

published 3y ago modified 8mo ago also GO-2023-2156

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The Cosmos SDK is used for Inter-Blockchain Communication Protocol (IBC) applications and middleware. The [packet-forward-middleware](https://github.com/cosmos/ibc-apps/tree/main/middleware/packet-forward-middleware) module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destination chain. The `packet-forward-middleware` module is vulnerable to potential chain-halt due to error non-determinism.

### Patches Please patch at your earliest convenience by applying one of the following patch versions, respective to the chain's ibc-go major version: v4.1.1 v5.2.1 v6.1.1

Patch / fix

  • go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 4.1.1
  • go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 5.2.1
  • go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 6.1.1

Is GHSA-w6rp-vxj2-fjhr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4
<4.1.1
4.1.1
go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5
<5.2.1
5.2.1
go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6
<6.1.1
6.1.1

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.