GHSA-7c94-gvvj-r3mg cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability
Full node operators must upgrade cheqd-node to mitigate a low-severity IBC protocol vulnerability that could potentially escalate in impact depending on node architecture.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7c94-gvvj-r3mg?
GHSA-7c94-gvvj-r3mg is a vulnerability in github.com/cheqd/cheqd-node, published on 5 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This vulnerability affects the ibc-go package for those running full nodes, dubbed "Huckleberry". According to their advisory:
> This issue is low-severity in general, and it has a low impact and likelihood of exploitation. Depending on how a full node is architected, this issue could potentially yield a high or critical severity vulnerability.
There is no vulnerability in the DID/resource modules for cheqd-node.
Patches
Node operators are requested to upgrade to cheqd-node v1.4.2. This is a non-state breaking release, and does not require a coordinated upgrade across all node operators.
Workarounds
No. Node operators are recommended to upgrade to the latest release version.
References
Which versions are affected by GHSA-7c94-gvvj-r3mg?
2 open source packages ship an affected version, including github.com/cheqd/cheqd-node.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cheqd/cheqd-node Go | All versions | 1.4.2 |
github.com/cheqd/cheqd-node Go | All versions | 1.4.2 |
How do I fix GHSA-7c94-gvvj-r3mg?
Upgrade github.com/cheqd/cheqd-node to 1.4.2 or later.
Is GHSA-7c94-gvvj-r3mg being exploited?
There is no known exploitation of GHSA-7c94-gvvj-r3mg in the wild and no public exploit code.