The x/crisis package does not cause chain halt in github.com/cosmos/cosmos-sdk

GHSA-qfc5-6r3j-jj22 · GO-2023-1821 · Published 05/07/2023 · updated 20/05/2024

In short

GO-2023-1821 is a not yet rated vulnerability affecting github.com/cosmos/cosmos-sdk.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/cosmos/cosmos-sdk Go	`all versions`	No fix yet

Description

If an invariant check fails on a Cosmos SDK network, and a transaction is sent to the x/crisis package to halt the chain, the chain does not halt as originally intended.

No patch will be released, as the package is planned to be deprecated and replaced.

References

cosmos/cosmos-sdk security advisory · ADVISORY
cosmos/cosmos-sdk · REPORT
cosmos/cosmos-sdk · REPORT

More vulnerabilities in github.com/cosmos/cosmos-sdk

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free