x/vulndb: potential Go vuln in github.com/cheqd/cheqd-node: GHSA-33cr-m232-xqch

[GoVulnBot]

Advisory GHSA-33cr-m232-xqch references a vulnerability in the following Go modules:

Module
github.com/cheqd/cheqd-node

Description:

Description

An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain.

This an upstream dependency used in cheqd-node, rather than a custom module.

Impact

Could result in a chain halt.

Patches

Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.7. This upgrade does not...

References:

• ADVISORY: GHSA-33cr-m232-xqch
• ADVISORY: GHSA-33cr-m232-xqch
• FIX: cosmos/ibc-go@59987d5
• WEB: GHSA-jg6f-48ff-5xrw

Cross references:

• github.com/cheqd/cheqd-node appears in 3 other report(s):
  • data/excluded/GO-2023-1824.yaml (x/vulndb: potential Go vuln in github.com/cheqd/cheqd-node: GHSA-7c94-gvvj-r3mg #1824) DEPENDENT_VULNERABILITY
  • data/excluded/GO-2023-1855.yaml (x/vulndb: potential Go vuln in github.com/cheqd/cheqd-node: GHSA-8qxh-2gh8-r923 #1855) DEPENDENT_VULNERABILITY
  • data/reports/GO-2022-1066.yaml (x/vulndb: potential Go vuln in github.com/cheqd/cheqd-node: GHSA-j92c-mmf7-j5x5 #1066)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cheqd/cheqd-node
      non_go_versions:
        - fixed: 3.1.7
      vulnerable_at: 1.4.5
summary: |-
    cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC
    Acknowledgement in github.com/cheqd/cheqd-node
ghsas:
    - GHSA-33cr-m232-xqch
references:
    - advisory: https://github.com/advisories/GHSA-33cr-m232-xqch
    - advisory: https://github.com/cheqd/cheqd-node/security/advisories/GHSA-33cr-m232-xqch
    - fix: https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748
    - web: https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw
source:
    id: GHSA-33cr-m232-xqch
    created: 2025-03-11T22:01:18.674293645Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/657255 mentions this issue: data/reports: add 7 reports