x/vulndb: potential Go vuln in github.com/cometbft/cometbft: GHSA-hg58-rf2h-6rr7

[GoVulnBot]

Advisory GHSA-hg58-rf2h-6rr7 references a vulnerability in the following Go modules:

Module
github.com/cometbft/cometbft

Description:
Name: ASA-2024-008: Instability during blocksync when syncing from malicious
peer Component: CometBFT Criticality: Medium
(ACMv1:
I:Moderate; L: Possible) Affected versions: < v0.38.7

Summary

An issue was identified for nodes syncing on an existing network during
blocksync in which a malicious peer could cause the syncing peer to panic, enter
into a catastrophic invalid syncing state or get stuck in blocksync mode, never
switching to consensus. It is recommended for all clients to adopt...

References:

• ADVISORY: GHSA-hg58-rf2h-6rr7
• ADVISORY: GHSA-hg58-rf2h-6rr7
• FIX: cometbft/cometbft@07866e1
• FIX: cometbft/cometbft@8ba2e4f

Cross references:

• Module github.com/cometbft/cometbft appears in issue x/vulndb: potential Go vuln in github.com/cometbft/cometbft: GHSA-hq58-p9mv-338c #2092 NOT_A_VULNERABILITY
• Module github.com/cometbft/cometbft appears in issue x/vulndb: potential Go vuln in github.com/cometbft/cometbft: GHSA-555p-m4v6-cqxv #2585 NOT_A_VULNERABILITY
• Module github.com/cometbft/cometbft appears in issue x/vulndb: potential Go vuln in github.com/cometbft/cometbft: CVE-2023-34450 #1882
• Module github.com/cometbft/cometbft appears in issue x/vulndb: potential Go vuln in github.com/cometbft/cometbft: CVE-2023-34451 #1883
• Module github.com/cometbft/cometbft appears in issue x/vulndb: potential Go vuln in github.com/cometbft/cometbft: GHSA-qr8r-m495-7hc4 #2471

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cometbft/cometbft
      versions:
        - introduced: 0.37.0
        - fixed: 0.37.7
        - introduced: 0.38.0
        - fixed: 0.38.8
      vulnerable_at: 0.38.7
      packages:
        - package: github.com/cometbft/cometbft
summary: CometBFT is unstability during blocksync when syncing from malicious peer in github.com/cometbft/cometbft
ghsas:
    - GHSA-hg58-rf2h-6rr7
references:
    - advisory: https://github.com/advisories/GHSA-hg58-rf2h-6rr7
    - advisory: https://github.com/cometbft/cometbft/security/advisories/GHSA-hg58-rf2h-6rr7
    - fix: https://github.com/cometbft/cometbft/commit/07866e11139127e415bd0339ac377b6e6a845533
    - fix: https://github.com/cometbft/cometbft/commit/8ba2e4f52d5e626e019501ba6420cc86d5de7857
source:
    id: GHSA-hg58-rf2h-6rr7
    created: 2024-06-28T15:01:18.378442217Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/596215 mentions this issue: data/reports: add GO-2024-2951