Insufficient Verification of Data Authenticity Affecting github.com/cosmos/interchain-security/v5/x/ccv/provider/keeper package, versions >=2.4.0-lsm <4.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMCOSMOSINTERCHAINSECURITYV5XCCVPROVIDERKEEPER-7721058
- published26 Aug 2024
- disclosed19 Aug 2024
- creditUnknown
Introduced: 19 Aug 2024
CVE NOT AVAILABLE CWE-345 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/cosmos/interchain-security/v5/x/ccv/provider/keeper to version 4.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to a missing check in the cryptographic equivocation evidence handling process. An attacker can manipulate the blockchain's integrity by submitting crafted evidence that bypasses the height verification.