mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-2557-x9mg-76w8 GHSA-4j93-fm92-rp4m
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,90 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2557-x9mg-76w8",
|
||||
"modified": "2024-02-21T00:13:46Z",
|
||||
"published": "2024-02-21T00:13:46Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"summary": "ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`",
|
||||
"details": "## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`\n\n**Component**: Cosmos SDK\n**Criticality**: Medium\n**Affected** Versions: Cosmos SDK versions <= 0.50.3; <= 0.47.8\n**Affected** Users: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Summary\n\nWhen using the default `PrepareProposalHandler` and the default `SenderNonceMempool`, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network.\n\n## Next Steps for Impacted Parties\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [KonradStaniec](https://github.com/KonradStaniec), [gitferry](https://github.com/gitferry), [SebastianElvis](https://github.com/SebastianElvis), and [vitsalis](https://github.com/vitsalis) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 16, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/cosmos/cosmos-sdk"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0.50.0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.50.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 0.50.3"
|
||||
}
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/cosmos/cosmos-sdk"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.47.9"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 0.47.8"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2557-x9mg-76w8"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-1285"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-02-21T00:13:46Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4j93-fm92-rp4m",
|
||||
"modified": "2024-02-21T00:12:51Z",
|
||||
"published": "2024-02-21T00:12:51Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"summary": "ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module",
|
||||
"details": "## ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module\n\n**Component**: Cosmos SDK\n**Criticality**: Low\n**Affected Versions**: Cosmos SDK versions <= 0.50.3; <= 0.47.8\n**Affected Users**: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Description\n\nA vulnerability was identified in the `x/auth/vesting` module, which can allow a user to create a periodic vesting account on a blocked address, for example a non-initialized module account. Additional validation was added to prevent creation of a periodic vesting account in this scenario.\n\nIf this case is triggered, there is the potential for a chain halt if the uninitialized account in question is called by `GetModuleAccount` in `Begin`/`EndBlock` of a module. This combination of an uninitialized blocked module account is not common. \n\n## Next Steps for Impacted Parties\n\nIf your chain has uninitialized blocked module accounts, it is recommended to proactively initialize them, as they are often initialized during a chain migration or during init genesis.\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [Dongsam](https://github.com/dongsam) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 30, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/cosmos/cosmos-sdk"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0.50.0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.50.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 0.50.3"
|
||||
}
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/cosmos/cosmos-sdk"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.47.9"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 0.47.8"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-4j93-fm92-rp4m"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-20"
|
||||
],
|
||||
"severity": "LOW",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-02-21T00:12:51Z",
|
||||
"nvd_published_at": null
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user