Race Condition Affecting github.com/cometbft/cometbft/types package, versions >=0.34.27-alpha.1 <0.34.34>=0.37.0 <0.37.11>=0.38.0 <0.38.12


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-GOLANG-GITHUBCOMCOMETBFTCOMETBFTTYPES-7897569
  • published5 Sept 2024
  • disclosed3 Sept 2024
  • creditUnknown

Introduced: 3 Sep 2024

CVE NOT AVAILABLE CWE-362  (opens in a new tab)

How to fix?

Upgrade github.com/cometbft/cometbft/types to version 0.34.34, 0.37.11, 0.38.12 or higher.

Overview

Affected versions of this package are vulnerable to Race Condition through the State object computation process. An attacker can cause a chain split by exploiting inconsistencies in the ProposerPriority field during state synchronization.

Note: This is only exploitable if validators run state sync using RPC nodes that are malicious or report invalid states for the proposer selection algorithm.

CVSS Scores

version 4.0
version 3.1