x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-47ww-ff84-4jrg

[GoVulnBot]

Advisory GHSA-47ww-ff84-4jrg references a vulnerability in the following Go modules:

Module
github.com/cosmos/cosmos-sdk

Description:
Name: ISA-2025-002: x/group can halt when erroring in EndBlocker
Component: CosmosSDK
Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2)
Affected versions: <= v0.47.16, <= 0.50.12
Affected users: Validators, Full nodes, Users on chains that utilize the groups module
Cosmos SDK chains in unpatched releases that use the x/group module are affected.

Description

An issue was discovered in the groups module where malicious proposals would result in an errors triggered in the module's...

References:

• ADVISORY: GHSA-47ww-ff84-4jrg
• ADVISORY: GHSA-47ww-ff84-4jrg
• FIX: cosmos/cosmos-sdk@cbd69fb

Cross references:

• github.com/cosmos/cosmos-sdk appears in 11 other report(s):
  • data/excluded/GO-2022-0255.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: CVE-2021-41135 #255) NOT_IMPORTABLE
  • data/excluded/GO-2023-2047.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-23px-mw2p-46qm #2047) NOT_IMPORTABLE
  • data/reports/GO-2023-1821.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-qfc5-6r3j-jj22 #1821)
  • data/reports/GO-2023-1861.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk #1861)
  • data/reports/GO-2023-1881.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-w5w5-2882-47pc #1881)
  • data/reports/GO-2024-2571.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-2557-x9mg-76w8 #2571)
  • data/reports/GO-2024-2572.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-4j93-fm92-rp4m #2572)
  • data/reports/GO-2024-2584.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-86h5-xcpx-cfqc #2584)
  • data/reports/GO-2024-2638.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-95rx-m9m5-m94v #2638)
  • data/reports/GO-2024-3339.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-8wcc-m6j2-qxvm #3339)
  • data/reports/GO-2025-3476.yaml (x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-x5vx-95h7-rv4p #3476)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cosmos/cosmos-sdk
      non_go_versions:
        - introduced: TODO (earliest fixed "0.47.17", vuln range "<= 0.47.16")
        - introduced: TODO (earliest fixed "0.50.13", vuln range ">= 0.50.0-alpha.0, <= 0.50.12")
      vulnerable_at: 0.50.13
summary: 'Cosmos SDK: x/group can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk'
ghsas:
    - GHSA-47ww-ff84-4jrg
references:
    - advisory: https://github.com/advisories/GHSA-47ww-ff84-4jrg
    - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg
    - fix: https://github.com/cosmos/cosmos-sdk/commit/cbd69fb1f4fac418c1f8c6253f5f91fb1263776a
notes:
    - fix: 'module merge error: could not merge versions of module github.com/cosmos/cosmos-sdk: invalid or non-canonical semver version (found TODO (earliest fixed "0.47.17", vuln range "<= 0.47.16"))'
source:
    id: GHSA-47ww-ff84-4jrg
    created: 2025-03-12T20:01:25.252024527Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/657595 mentions this issue: data/reports: add 2 reports