{"answers":{"affected":"2 open source packages ship an affected version, including github.com/cometbft/cometbft.","exploited":"There is no known exploitation of GHSA-555p-m4v6-cqxv in the wild and no public exploit code.","fix":"No fix has been published for GHSA-555p-m4v6-cqxv yet. Limit exposure of the affected software until one is available.","what":"GHSA-555p-m4v6-cqxv is a vulnerability in github.com/cometbft/cometbft, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-555p-m4v6-cqxv and fix it if it is affected.\n\nWhat it is: GHSA-555p-m4v6-cqxv is a vulnerability in github.com/cometbft/cometbft, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-555p-m4v6-cqxv in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cometbft/cometbft (Go): affected all versions up to 0.38.5; no fix listed\n- github.com/cometbft/cometbft (Go): affected all versions up to 0.38.5; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/ (Markdown: https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/index.md)","id":"GHSA-555p-m4v6-cqxv","markdown":"https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/index.md","name":"GHSA-555p-m4v6-cqxv","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"configuration_change","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"CometBFT consensus engine","requires_auth":"none","summary":"Default evidence expiration settings in CometBFT may allow Byzantine behavior to go unpunished if evidence is discovered after the short validity window.","user_interaction":"not_required","vuln_class":"misconfiguration"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## ASA-2024-004: Default configuration param for Evidence may limit window of validity\n\n**Component**: CometBFT\n**Criticality**: Low\n**Affected versions**: All\n**Affected users**: Validators, Chain Builders + Maintainers\n\n## Summary\n\nA default configuration in CometBFT has been found to be small for common use cases, and may prevent the slashing mechanism from working in specific cases.  The default values for `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` consensus parameters may not be sufficient for common use cases to provide coverage for the entire unbonding period for a chain (`Staking.UnbondingTime`). If the conditions of both of these parameters are exceeded, evidence may be prematurely expired and considered no longer valid, potentially allowing for unpunished Byzantine behavior if evidence is discovered outside of that window.\n\n## Next Steps for Chains and Validators\n\nIt is recommended that chain ecosystems and their maintainers set the consensus parameters `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` to values appropriate for their use case:  \n- `EvidenceParams.MaxAgeDuration` (set in nanoseconds) should exceed the duration of the chain’s unbonding period\n- `EvidenceParams.MaxAgeNumBlocks` should exceed the number of estimated blocks that will be produced by your chain throughout the unbonding period\n\nFor more information about evidence in CometBFT, please see: https://docs.cometbft.com/v0.37/spec/consensus/evidence.\n\nFor more information about the cosmos-sdk  `x/staking` and `x/slashing` modules, and `UnbondingTime` parameter, please see: https://docs.cosmos.network/v0.50/build/modules/staking and https://docs.cosmos.network/v0.50/build/modules/slashing.\n\nCometBFT is designed to be configurable by chains, and implements many different configuration variables and parameters to allow chain developers, validators, node operators, and chain participants to customize it best to their use case. \n\nAs more chains adopt the Interchain Stack for new and cutting-edge use cases, the CometBFT team recommends that all chains regularly evaluate their consensus parameters and configurations to ensure they meet the needs of their ecosystem as their networks mature. \n\nA Github Security Advisory for this issue is available in the [CometBFT repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-555p-m4v6-cqxv). For more information about CometBFT, see https://docs.cometbft.com/. \n\nThis issue was reported to the Cosmos Bug Bounty Program on HackerOne on February 15, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"ASA-2024-004: Default configuration param for Evidence may limit window of validity","id":"GHSA-555p-m4v6-cqxv","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"misconfiguration","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["0.38.5"],"package":"github.com/cometbft/cometbft","purl":null,"source":"GHSA-555p-m4v6-cqxv"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["0.38.5"],"package":"github.com/cometbft/cometbft","purl":"pkg:golang/github.com/cometbft/cometbft","source":"GHSA-555p-m4v6-cqxv"}],"products":null,"published":"2024-02-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Default evidence expiration settings in CometBFT may allow Byzantine behavior to go unpunished if evidence is discovered after the short validity window.","url":"https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/"}