crates.io/tendermint-light-client-verifier: high
tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators
Action: Upgrade tendermint-light-client-verifier to 0.40.3 or later.
cargo update -p tendermint-light-client-verifier --precise 0.40.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.40.3 | - |
Fixed versions
| 0.40.3 |
Sources
- osv: GHSA-6jrf-4jv4-r9mw
- https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-6jrf-4jv4-r9mw
- https://github.com/informalsystems/tendermint-rs/commit/1aabcfe6a3c0678db22097543f7f7a662f0db34b
- https://github.com/informalsystems/tendermint-rs
published · modified · JSON