no cvss
—
GO-2023-1860 json
IBC protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go
published 3y ago modified 2y ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability.
Patch / fix
- go github.com/cosmos/ibc-go/v7 7.0.1
- go github.com/cosmos/ibc-go/v6 6.1.1
- go github.com/cosmos/ibc-go/v5 5.2.1, 5.3.1
- go github.com/cosmos/ibc-go/v4 4.1.3, 4.2.2, 4.3.1, 4.4.1
Is GO-2023-1860 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/cosmos/ibc-go/v7 | <7.0.1 |
7.0.1 |
| go | github.com/cosmos/ibc-go/v6 | <6.1.1 |
6.1.1 |
| go | github.com/cosmos/ibc-go/v5 | <5.2.1 >=5.3.0, <5.3.1 |
5.2.1 5.3.1 |
| go | github.com/cosmos/ibc-go/v4 | <4.1.3 >=4.2.0, <4.2.2 >=4.3.0, <4.3.1 >=4.4.0, <4.4.1 |
4.1.3 4.2.2 4.3.1 4.4.1 |
References
Sources
- OSV GO-2023-1860
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.