{"action":"Upgrade github.com/cometbft/cometbft to 0.37.7 or later.","affected":[{"fixed":"0.37.7","introduced":"0.37.0"},{"fixed":"0.38.8","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.37.7","0.38.8"],"ghsa_id":"GHSA-hg58-rf2h-6rr7","id":"tcs_01M5KFCGGGVAAY7WAVHNSX5JA6","modified_at":"2024-07-05T21:31:45Z","published_at":"2024-06-28T14:33:33Z","references":["https://osv.dev/vulnerability/GHSA-hg58-rf2h-6rr7","https://github.com/cometbft/cometbft/security/advisories/GHSA-hg58-rf2h-6rr7","https://github.com/cometbft/cometbft/commit/07866e11139127e415bd0339ac377b6e6a845533","https://github.com/cometbft/cometbft/commit/8ba2e4f52d5e626e019501ba6420cc86d5de7857","https://github.com/cometbft/cometbft"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hg58-rf2h-6rr7","url":"https://osv.dev/vulnerability/GHSA-hg58-rf2h-6rr7"}],"summary":"CometBFT is unstability during blocksync when syncing from malicious peer"}