{"answers":{"affected":"3 open source packages ship an affected version, including github.com/cometbft/cometbft.","exploited":"There is no known exploitation of GHSA-p7mv-53f2-4cwj in the wild and no public exploit code.","fix":"Upgrade github.com/cometbft/cometbft to 0.38.15 or later.","what":"GHSA-p7mv-53f2-4cwj is a denial of service vulnerability in github.com/cometbft/cometbft, published on 6 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-p7mv-53f2-4cwj and fix it if it is affected.\n\nWhat it is: GHSA-p7mv-53f2-4cwj is a denial of service vulnerability in github.com/cometbft/cometbft, published on 6 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-p7mv-53f2-4cwj in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cometbft/cometbft (Go): affected from 0.38.0; fixed in 0.38.15\n- github.com/cometbft/cometbft (Go): affected from 0.38.0; fixed in 0.38.15\n- github.com/cometbft/cometbft (Go): affected from 0.38.0; fixed in 0.38.15\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-p7mv-53f2-4cwj/ (Markdown: https://insights.sbomify.com/GHSA-p7mv-53f2-4cwj/index.md)","id":"GHSA-p7mv-53f2-4cwj","markdown":"https://insights.sbomify.com/GHSA-p7mv-53f2-4cwj/index.md","name":"GHSA-p7mv-53f2-4cwj","record":{"aliases":["GO-2024-3259"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"CometBFT consensus node","requires_auth":"none","summary":"A malicious peer can crash a CometBFT node by sending a malformed Precommit vote if vote extensions are enabled, causing a denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Name: ASA-2024-011: Vote Extensions: Panic when receiving a Pre-commit with an invalid data\nComponent: CometBFT\nCriticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: `\u003e= 0.38.x`, unreleased `v1.x` and `main` development branches\nAffected users: Chain Builders + Maintainers, Validators\n\n### Impact\n\nA CometBFT node running in a network with [vote extensions][abci-spec] enabled could produce an invalid `Vote` message and send it to its peers. The invalid field of the `Vote` message is the `ValidatorIndex`, which identifies the sender in the `ValidatorSet` running that height of consensus. This field is ordinarily verified in the processing of `Vote` messages, but it turns out that in the case of a `Vote` message of type `Precommit` and for a non-`nil` `BlockID`, [a logic was introduced](https://github.com/cometbft/cometbft/blame/46621a87064b2ae235e122e66d9b22417b3aa35e/internal/consensus/state.go#L2357-L2364) before this ordinary verification to handle the attached vote extension. This introduced logic (not present in releases prior to `0.38.x`) does not double-check the validity of the `ValidatorIndex` field. The result is a panic in the execution of the node receiving and processing such message.\n\n#### Impact Qualification\nThis condition requires the introduction of malicious code in the full node sending this `Vote` message to its peers. Namely, nodes running upstream code cannot produce invalid `Vote` messages, with non-existing `ValidatorIndex`. Moreover, networks utilizing default behavior, where vote extensions are not enabled, are not affected by this issue.\n\n### Patches\n\nThe new CometBFT release [`v0.38.15`][v0.38.15] fixes this issue.\n\nUnreleased code in the `main` and `v1.x` branches, and experimental code in the `v0.38-experimental` and `v1.x-experimental` branches are patched as well.\n\n### Workarounds\n\nWhen the consensus code panics after receiving an invalid `Vote` message, the operator can identify the peer from which that message was received. This may require increasing the logging level of the `consensus` module. This peer can then be subsequently banned at the p2p layer as a temporary mitigation.  \n\n### References\n\n- [ABCI spec][abci-spec], in particular the operation of vote extensions\n- [Patched v0.38 release][v0.38.15]\n\n[abci-spec]: https://docs.cometbft.com/v0.38/spec/abci/abci++_basic_concepts\n[v0.38.15]: https://github.com/cometbft/cometbft/releases/tag/v0.38.15\n\n### Timeline\n\n* October 21, 2024, 3:26pm PST: Issue reported to the Cosmos Bug Bounty program\n* October 21, 2024, 3:41pm PST: Issue triaged by Amulet on-call, and distributed to Core team\n* October 29, 2024, 11:35pm PST: Core team completes validation of issue\n* October 30, 2024, 3:33am PST: Core team completes patch for issue\n* October 30, 2024, 5:09am PST: Amulet creates coordination plan; schedule for distribution\n* November 4, 2024, 8:00pm GMT: Pre-notification delivered\n* November 6, 2024, 8:00am GMT: Patch made available\n\nThis issue was reported by [corverroos](https://github.com/corverroos) to the Cosmos Bug Bounty Program on HackerOne on October 21, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io).  For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.  \n\nA Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-p7mv-53f2-4cwj). For more information about CometBFT, see https://docs.cometbft.com/.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data","id":"GHSA-p7mv-53f2-4cwj","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.38.15"],"introduced":["0.38.0"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":null,"source":"GHSA-p7mv-53f2-4cwj"},{"ecosystem":"Go","fixed":["0.38.15"],"introduced":["0.38.0"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":"pkg:golang/github.com/cometbft/cometbft","source":"GHSA-p7mv-53f2-4cwj"},{"ecosystem":"Go","fixed":["0.38.15"],"introduced":["0.38.0"],"last_affected":[],"package":"github.com/cometbft/cometbft","purl":"pkg:golang/github.com/cometbft/cometbft","source":"GO-2024-3259"}],"products":null,"published":"2024-11-06","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A malicious peer can crash a CometBFT node by sending a malformed Precommit vote if vote extensions are enabled, causing a denial of service.","url":"https://insights.sbomify.com/GHSA-p7mv-53f2-4cwj/"}