Go/github.com/cosmos/cosmos-sdk: high
Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt
Action: Upgrade github.com/cosmos/cosmos-sdk to 0.50.14 or later.
go get github.com/cosmos/cosmos-sdk@v0.50.14go get github.com/cosmos/cosmos-sdk@v0.53.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.50.14 | - |
| 0.52.0-alpha.1 | 0.53.3 | - |
Fixed versions
| 0.50.14 | 0.53.3 |
Sources
- osv: GHSA-p22h-3m2v-cmgh
- https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-p22h-3m2v-cmgh
- https://github.com/cosmos/cosmos-sdk/commit/c4a14fa7b6828432fdabdb8b4af68ade9403ce49
- https://github.com/cosmos/cosmos-sdk/commit/f2e6295b662fdb27ea33da1296c29588ccdaab42
- https://github.com/cosmos/cosmos-sdk
published · modified · JSON