diff --git a/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json b/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json new file mode 100644 index 00000000000..028840dfe12 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2557-x9mg-76w8", + "modified": "2024-02-21T00:13:46Z", + "published": "2024-02-21T00:13:46Z", + "aliases": [ + + ], + "summary": "ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`", + "details": "## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`\n\n**Component**: Cosmos SDK\n**Criticality**: Medium\n**Affected** Versions: Cosmos SDK versions <= 0.50.3; <= 0.47.8\n**Affected** Users: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Summary\n\nWhen using the default `PrepareProposalHandler` and the default `SenderNonceMempool`, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network.\n\n## Next Steps for Impacted Parties\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [KonradStaniec](https://github.com/KonradStaniec), [gitferry](https://github.com/gitferry), [SebastianElvis](https://github.com/SebastianElvis), and [vitsalis](https://github.com/vitsalis) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 16, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/cosmos-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.50.0" + }, + { + "fixed": "0.50.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.50.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/cosmos-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.47.9" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.47.8" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2557-x9mg-76w8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/cosmos-sdk" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1285" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:13:46Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-4j93-fm92-rp4m/GHSA-4j93-fm92-rp4m.json b/advisories/github-reviewed/2024/02/GHSA-4j93-fm92-rp4m/GHSA-4j93-fm92-rp4m.json new file mode 100644 index 00000000000..b4d9753152d --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-4j93-fm92-rp4m/GHSA-4j93-fm92-rp4m.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4j93-fm92-rp4m", + "modified": "2024-02-21T00:12:51Z", + "published": "2024-02-21T00:12:51Z", + "aliases": [ + + ], + "summary": "ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module", + "details": "## ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module\n\n**Component**: Cosmos SDK\n**Criticality**: Low\n**Affected Versions**: Cosmos SDK versions <= 0.50.3; <= 0.47.8\n**Affected Users**: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Description\n\nA vulnerability was identified in the `x/auth/vesting` module, which can allow a user to create a periodic vesting account on a blocked address, for example a non-initialized module account. Additional validation was added to prevent creation of a periodic vesting account in this scenario.\n\nIf this case is triggered, there is the potential for a chain halt if the uninitialized account in question is called by `GetModuleAccount` in `Begin`/`EndBlock` of a module. This combination of an uninitialized blocked module account is not common. \n\n## Next Steps for Impacted Parties\n\nIf your chain has uninitialized blocked module accounts, it is recommended to proactively initialize them, as they are often initialized during a chain migration or during init genesis.\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [Dongsam](https://github.com/dongsam) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 30, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/cosmos-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.50.0" + }, + { + "fixed": "0.50.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.50.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/cosmos-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.47.9" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.47.8" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-4j93-fm92-rp4m" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/cosmos-sdk" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:12:51Z", + "nvd_published_at": null + } +} \ No newline at end of file