{"action":"Upgrade github.com/cometbft/cometbft to 0.37.11 or later.","affected":[{"fixed":"0.37.11","introduced":"0.37.0"},{"fixed":"0.38.12","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.37.11","0.38.12"],"ghsa_id":"GHSA-g5xx-c4hv-9ccc","id":"tcs_01M5KG5829APCA3T038TS9Z7QM","modified_at":"2024-09-13T22:27:57.042637Z","published_at":"2024-09-13T21:55:06Z","references":["https://osv.dev/vulnerability/GO-2024-3112","https://github.com/cometbft/cometbft/security/advisories/GHSA-g5xx-c4hv-9ccc","https://github.com/cometbft/cometbft/commit/3937e00a339ee6b861d75997b4f6c87d867b74f2","https://github.com/cometbft/cometbft/commit/52c00a537f8f56ed94b4a5c8af6e3fecff468b55"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-3112","url":"https://osv.dev/vulnerability/GO-2024-3112"}],"summary":"CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft"}