Go/github.com/cometbft/cometbft/light: medium 4.7
CometBFT's state syncing validator from malicious node may lead to a chain split
Action: Upgrade github.com/cometbft/cometbft/light to 0.34.34 or later.
go get github.com/cometbft/cometbft/light@v0.34.34go get github.com/cometbft/cometbft/light@v0.37.11go get github.com/cometbft/cometbft/light@v0.38.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.34.0 | 0.34.34 | - |
| 0.37.0 | 0.37.11 | - |
| 0.38.0 | 0.38.12 | - |
Fixed versions
| 0.34.34 | 0.37.11 | 0.38.12 |
Sources
- osv: GHSA-g5xx-c4hv-9ccc
- https://github.com/cometbft/cometbft/security/advisories/GHSA-g5xx-c4hv-9ccc
- https://github.com/cometbft/cometbft/commit/3937e00a339ee6b861d75997b4f6c87d867b74f2
- https://github.com/cometbft/cometbft/commit/52c00a537f8f56ed94b4a5c8af6e3fecff468b55
- https://github.com/cometbft/cometbft
- https://pkg.go.dev/vuln/GO-2024-3112
published · modified · JSON