GHSA-h2rp-8vpx-q9r4

Source

https://github.com/advisories/GHSA-h2rp-8vpx-q9r4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-h2rp-8vpx-q9r4/GHSA-h2rp-8vpx-q9r4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h2rp-8vpx-q9r4

Aliases

GO-2025-3520

Published

2025-03-13T16:26:11Z

Modified

2025-03-25T20:22:23.406725Z

Summary

cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

Details

Description

There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.

ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.

ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.

Impact

If unaddressed, this could result in a chain halt.

Patches

Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.

Database specific

{
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-13T16:26:11Z",
    "nvd_published_at": null
}

References

Affected packages

Go / github.com/cheqd/cheqd-node

Package

Name: github.com/cheqd/cheqd-node; View open source insights on deps.dev
Purl: pkg:golang/github.com/cheqd/cheqd-node

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-h2rp-8vpx-q9r4/GHSA-h2rp-8vpx-q9r4.json"