Insufficient Verification of Data Authenticity Affecting mithril-client package, versions <0.12.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-MITHRILCLIENT-10393988
- published19 Jun 2025
- disclosed7 May 2025
- creditUnknown
Introduced: 7 May 2025
CVE NOT AVAILABLE CWE-345 (opens in a new tab)How to fix?
Upgrade mithril-client to version 0.12.2 or higher.
Overview
mithril-client is a Mithril client library.
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through the snapshot certification process. An attacker can introduce inconsistencies into the ledger state by distributing tampered snapshots. This vulnerability is only exploitable if the node starts with a pre-computed ledger state that has not undergone full verification.
Workaround
The vulnerability can be mitigated by ensuring that the Mithril aggregator signs the ledger state snapshot and the latest immutable file using an IOG-owned key, and the client library and CLI validate the signature of these files upon download.