Skip to content

Commit e6a10f5

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 2 reports
 - data/reports/GO-2025-3516.yaml - data/reports/GO-2025-3517.yaml Fixes #3516 Fixes #3517 Change-Id: I80bc1c3564e7e04e0d6ef4f8b91d8d4200ecaac8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/657595 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Neal Patel <[email protected]>
1 parent a4b4ced commit e6a10f5

File tree

4 files changed

+330
-0
lines changed

4 files changed

+330
-0
lines changed

‎data/osv/GO-2025-3516.json

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3516",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-47ww-ff84-4jrg"
8+
],
9+
"summary": "Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/",
10+
"details": "Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cosmos/cosmos-sdk",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.47.17"
26+
},
27+
{
28+
"introduced": "0.50.0-alpha.0"
29+
},
30+
{
31+
"fixed": "0.50.13"
32+
}
33+
]
34+
}
35+
],
36+
"ecosystem_specific": {
37+
"imports": [
38+
{
39+
"path": "github.com/cosmos/cosmos-sdk/x/group/keeper",
40+
"symbols": [
41+
"Keeper.Exec",
42+
"Keeper.SubmitProposal",
43+
"Keeper.TallyProposalsAtVPEnd",
44+
"Keeper.Vote",
45+
"Keeper.doTallyAndUpdate"
46+
]
47+
}
48+
]
49+
}
50+
}
51+
],
52+
"references": [
53+
{
54+
"type": "ADVISORY",
55+
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg"
56+
},
57+
{
58+
"type": "FIX",
59+
"url": "https://github.com/cosmos/cosmos-sdk/commit/cbd69fb1f4fac418c1f8c6253f5f91fb1263776a"
60+
}
61+
],
62+
"database_specific": {
63+
"url": "https://pkg.go.dev/vuln/GO-2025-3516",
64+
"review_status": "REVIEWED"
65+
}
66+
}

‎data/osv/GO-2025-3517.json

+191
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3517",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-4wf3-5qj9-368v"
8+
],
9+
"summary": "Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go",
10+
"details": "Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cosmos/ibc-go",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/cosmos/ibc-go/v2",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
}
41+
]
42+
}
43+
],
44+
"ecosystem_specific": {}
45+
},
46+
{
47+
"package": {
48+
"name": "github.com/cosmos/ibc-go/v3",
49+
"ecosystem": "Go"
50+
},
51+
"ranges": [
52+
{
53+
"type": "SEMVER",
54+
"events": [
55+
{
56+
"introduced": "0"
57+
}
58+
]
59+
}
60+
],
61+
"ecosystem_specific": {}
62+
},
63+
{
64+
"package": {
65+
"name": "github.com/cosmos/ibc-go/v4",
66+
"ecosystem": "Go"
67+
},
68+
"ranges": [
69+
{
70+
"type": "SEMVER",
71+
"events": [
72+
{
73+
"introduced": "0"
74+
}
75+
]
76+
}
77+
],
78+
"ecosystem_specific": {}
79+
},
80+
{
81+
"package": {
82+
"name": "github.com/cosmos/ibc-go/v5",
83+
"ecosystem": "Go"
84+
},
85+
"ranges": [
86+
{
87+
"type": "SEMVER",
88+
"events": [
89+
{
90+
"introduced": "0"
91+
}
92+
]
93+
}
94+
],
95+
"ecosystem_specific": {}
96+
},
97+
{
98+
"package": {
99+
"name": "github.com/cosmos/ibc-go/v6",
100+
"ecosystem": "Go"
101+
},
102+
"ranges": [
103+
{
104+
"type": "SEMVER",
105+
"events": [
106+
{
107+
"introduced": "0"
108+
}
109+
]
110+
}
111+
],
112+
"ecosystem_specific": {}
113+
},
114+
{
115+
"package": {
116+
"name": "github.com/cosmos/ibc-go/v7",
117+
"ecosystem": "Go"
118+
},
119+
"ranges": [
120+
{
121+
"type": "SEMVER",
122+
"events": [
123+
{
124+
"introduced": "0"
125+
},
126+
{
127+
"fixed": "7.10.0"
128+
}
129+
]
130+
}
131+
],
132+
"ecosystem_specific": {
133+
"imports": [
134+
{
135+
"path": "github.com/cosmos/ibc-go/v7/modules/core/04-channel/keeper",
136+
"symbols": [
137+
"Keeper.AcknowledgePacket"
138+
]
139+
}
140+
]
141+
}
142+
},
143+
{
144+
"package": {
145+
"name": "github.com/cosmos/ibc-go/v8",
146+
"ecosystem": "Go"
147+
},
148+
"ranges": [
149+
{
150+
"type": "SEMVER",
151+
"events": [
152+
{
153+
"introduced": "8.0.0-alpha.1"
154+
},
155+
{
156+
"fixed": "8.7.0"
157+
}
158+
]
159+
}
160+
],
161+
"ecosystem_specific": {
162+
"imports": [
163+
{
164+
"path": "github.com/cosmos/ibc-go/v8/modules/core/04-channel/keeper",
165+
"symbols": [
166+
"Keeper.AcknowledgePacket"
167+
]
168+
}
169+
]
170+
}
171+
}
172+
],
173+
"references": [
174+
{
175+
"type": "ADVISORY",
176+
"url": "https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v"
177+
},
178+
{
179+
"type": "WEB",
180+
"url": "https://github.com/cosmos/ibc-go/releases/tag/v7.10.0"
181+
},
182+
{
183+
"type": "WEB",
184+
"url": "https://github.com/cosmos/ibc-go/releases/tag/v8.7.0"
185+
}
186+
],
187+
"database_specific": {
188+
"url": "https://pkg.go.dev/vuln/GO-2025-3517",
189+
"review_status": "REVIEWED"
190+
}
191+
}

‎data/reports/GO-2025-3516.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: GO-2025-3516
2+
modules:
3+
- module: github.com/cosmos/cosmos-sdk
4+
versions:
5+
- fixed: 0.47.17
6+
- introduced: 0.50.0-alpha.0
7+
- fixed: 0.50.13
8+
vulnerable_at: 0.50.12
9+
packages:
10+
- package: github.com/cosmos/cosmos-sdk/x/group/keeper
11+
symbols:
12+
- Keeper.doTallyAndUpdate
13+
derived_symbols:
14+
- Keeper.Exec
15+
- Keeper.SubmitProposal
16+
- Keeper.TallyProposalsAtVPEnd
17+
- Keeper.Vote
18+
summary: Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/
19+
ghsas:
20+
- GHSA-47ww-ff84-4jrg
21+
references:
22+
- advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg
23+
- fix: https://github.com/cosmos/cosmos-sdk/commit/cbd69fb1f4fac418c1f8c6253f5f91fb1263776a
24+
source:
25+
id: GHSA-47ww-ff84-4jrg
26+
created: 2025-03-13T10:52:36.932387-04:00
27+
review_status: REVIEWED

‎data/reports/GO-2025-3517.yaml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: GO-2025-3517
2+
modules:
3+
- module: github.com/cosmos/ibc-go
4+
vulnerable_at: 1.5.0
5+
- module: github.com/cosmos/ibc-go/v2
6+
vulnerable_at: 2.5.0
7+
- module: github.com/cosmos/ibc-go/v3
8+
vulnerable_at: 3.4.0
9+
- module: github.com/cosmos/ibc-go/v4
10+
vulnerable_at: 4.6.0
11+
- module: github.com/cosmos/ibc-go/v5
12+
vulnerable_at: 5.4.0
13+
- module: github.com/cosmos/ibc-go/v6
14+
vulnerable_at: 6.3.1
15+
- module: github.com/cosmos/ibc-go/v7
16+
versions:
17+
- fixed: 7.10.0
18+
vulnerable_at: 7.9.2
19+
packages:
20+
- package: github.com/cosmos/ibc-go/v7/modules/core/04-channel/keeper
21+
symbols:
22+
- Keeper.AcknowledgePacket
23+
- module: github.com/cosmos/ibc-go/v8
24+
versions:
25+
- introduced: 8.0.0-alpha.1
26+
- fixed: 8.7.0
27+
vulnerable_at: 8.6.1
28+
packages:
29+
- package: github.com/cosmos/ibc-go/v8/modules/core/04-channel/keeper
30+
symbols:
31+
- Keeper.AcknowledgePacket
32+
summary: |-
33+
Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result
34+
in a chain halt in github.com/cosmos/ibc-go
35+
ghsas:
36+
- GHSA-4wf3-5qj9-368v
37+
references:
38+
- advisory: https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v
39+
- web: https://github.com/cosmos/ibc-go/releases/tag/v7.10.0
40+
- web: https://github.com/cosmos/ibc-go/releases/tag/v8.7.0
41+
notes:
42+
- advisory lists v7,v8 as vulnerable with fixes and <v6 as potentially vulnerable with no fixes
43+
source:
44+
id: GHSA-4wf3-5qj9-368v
45+
created: 2025-03-13T10:52:34.060905-04:00
46+
review_status: REVIEWED

0 commit comments

Comments
 (0)