Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-2557-x9mg-76w8 #2571

Closed
GoVulnBot opened this issue Feb 21, 2024 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/cosmos/cosmos-sdk: GHSA-2557-x9mg-76w8 #2571

GoVulnBot opened this issue Feb 21, 2024 · 3 comments
Assignees
@zpavlinovic @tatianab
Labels
high priority

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-2557-x9mg-76w8, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/cosmos/cosmos-sdk 0.47.9 <= 0.47.8

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/cosmos/cosmos-sdk
      versions:
        - introduced: TODO (earliest fixed "0.47.9", vuln range "<= 0.47.8")
      packages:
        - package: github.com/cosmos/cosmos-sdk
    - module: github.com/cosmos/cosmos-sdk
      versions:
        - introduced: TODO (earliest fixed "0.50.4", vuln range ">= 0.50.0, <= 0.50.3")
      packages:
        - package: github.com/cosmos/cosmos-sdk
summary: |-
    ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals
    when used with default `SenderNonceMempool`
ghsas:
    - GHSA-2557-x9mg-76w8
references:
    - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2557-x9mg-76w8
    - web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9
    - web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4
    - advisory: https://github.com/advisories/GHSA-2557-x9mg-76w8
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/582535 mentions this issue: data/reports: batch add unreviewed reports

@tatianab tatianab assigned tatianab and unassigned rolandshoemaker May 17, 2024
@zpavlinovic zpavlinovic self-assigned this May 22, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/587535 mentions this issue: data/reports: add GO-2024-2571

@zpavlinovic zpavlinovic reopened this May 23, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/587836 mentions this issue: data/reports: updates GO-2024-2571.yaml

gopherbot pushed a commit that referenced this issue May 23, 2024
@zpavlinovic
data/reports: updates GO-2024-2571.yaml
c9dc217 
    Updates #2571

Change-Id: I94a71d44c444ee9314d8ba30a5fc092e4c4be439
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/587836
Run-TryBot: Zvonimir Pavlinovic <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
@GoVulnBot GoVulnBot mentioned this issue Dec 16, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Feb 20, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zpavlinovic zpavlinovic

@tatianab tatianab

Labels
high priority
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@zpavlinovic @rolandshoemaker @tatianab @gopherbot @GoVulnBot