{"action":"Upgrade github.com/cometbft/cometbft/light to 0.34.34 or later.","affected":[{"fixed":"0.34.34","introduced":"0.34.0"},{"fixed":"0.37.11","introduced":"0.37.0"},{"fixed":"0.38.12","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft/light","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.34.34","0.37.11","0.38.12"],"ghsa_id":"GHSA-g5xx-c4hv-9ccc","id":"tcs_01M5KFAC3699SGRBZWDNVYCSH8","modified_at":"2024-11-18T16:27:09Z","published_at":"2024-09-03T20:03:08Z","references":["https://osv.dev/vulnerability/GHSA-g5xx-c4hv-9ccc","https://github.com/cometbft/cometbft/security/advisories/GHSA-g5xx-c4hv-9ccc","https://github.com/cometbft/cometbft/commit/3937e00a339ee6b861d75997b4f6c87d867b74f2","https://github.com/cometbft/cometbft/commit/52c00a537f8f56ed94b4a5c8af6e3fecff468b55","https://github.com/cometbft/cometbft","https://pkg.go.dev/vuln/GO-2024-3112"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-g5xx-c4hv-9ccc","url":"https://osv.dev/vulnerability/GHSA-g5xx-c4hv-9ccc"}],"summary":"CometBFT's state syncing validator from malicious node may lead to a chain split"}