# GHSA-555p-m4v6-cqxv: ASA-2024-004: Default configuration param for Evidence may limit window of validity > Default evidence expiration settings in CometBFT may allow Byzantine behavior to go unpunished if evidence is discovered after the short validity window. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 28 Feb 2024 ## What is GHSA-555p-m4v6-cqxv? GHSA-555p-m4v6-cqxv is a vulnerability in github.com/cometbft/cometbft, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description ## ASA-2024-004: Default configuration param for Evidence may limit window of validity **Component**: CometBFT **Criticality**: Low **Affected versions**: All **Affected users**: Validators, Chain Builders + Maintainers ## Summary A default configuration in CometBFT has been found to be small for common use cases, and may prevent the slashing mechanism from working in specific cases. The default values for `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` consensus parameters may not be sufficient for common use cases to provide coverage for the entire unbonding period for a chain (`Staking.UnbondingTime`). If the conditions of both of these parameters are exceeded, evidence may be prematurely expired and considered no longer valid, potentially allowing for unpunished Byzantine behavior if evidence is discovered outside of that window. ## Next Steps for Chains and Validators It is recommended that chain ecosystems and their maintainers set the consensus parameters `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` to values appropriate for their use case: - `EvidenceParams.MaxAgeDuration` (set in nanoseconds) should exceed the duration of the chain’s unbonding period - `EvidenceParams.MaxAgeNumBlocks` should exceed the number of estimated blocks that will be produced by your chain throughout the unbonding period For more information about evidence in CometBFT, please see: https://docs.cometbft.com/v0.37/spec/consensus/evidence. For more information about the cosmos-sdk `x/staking` and `x/slashing` modules, and `UnbondingTime` parameter, please see: https://docs.cosmos.network/v0.50/build/modules/staking and https://docs.cosmos.network/v0.50/build/modules/slashing. CometBFT is designed to be configurable by chains, and implements many different configuration variables and parameters to allow chain developers, validators, node operators, and chain participants to customize it best to their use case. As more chains adopt the Interchain Stack for new and cutting-edge use cases, the CometBFT team recommends that all chains regularly evaluate their consensus parameters and configurations to ensure they meet the needs of their ecosystem as their networks mature. A Github Security Advisory for this issue is available in the [CometBFT repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-555p-m4v6-cqxv). For more information about CometBFT, see https://docs.cometbft.com/. This issue was reported to the Cosmos Bug Bounty Program on HackerOne on February 15, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos. ## Which versions are affected by GHSA-555p-m4v6-cqxv? 2 open source packages ship an affected version, including github.com/cometbft/cometbft. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `github.com/cometbft/cometbft` | Go | All versions to 0.38.5 | None | | `github.com/cometbft/cometbft` | Go | All versions to 0.38.5 | None | ## How do I fix GHSA-555p-m4v6-cqxv? No fix has been published for GHSA-555p-m4v6-cqxv yet. Limit exposure of the affected software until one is available. ## Is GHSA-555p-m4v6-cqxv being exploited? There is no known exploitation of GHSA-555p-m4v6-cqxv in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-555p-m4v6-cqxv and fix it if it is affected. What it is: GHSA-555p-m4v6-cqxv is a vulnerability in github.com/cometbft/cometbft, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-555p-m4v6-cqxv in the wild and no public exploit code. Affected packages and fixed versions: - github.com/cometbft/cometbft (Go): affected all versions up to 0.38.5; no fix listed - github.com/cometbft/cometbft (Go): affected all versions up to 0.38.5; no fix listed Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/ (Markdown: https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-555p-m4v6-cqxv --- From sbomify Insights: https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/ Summaries are generated and may contain mistakes; the official description above is the record.