GitHub Advisoryadvisory · Go

GHSA-h2rp-8vpx-q9r4 cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

CRITICAL Published 2025-03-13 Modified 2025-03-13 Official page ↗
Ecosystem
Go
Packages
github.com/cheqd/cheqd-node
Severity
Critical
Weaknesses
CWE-1395
Reviewed
2025-03-13

Affected packages

• Go github.com/cheqd/cheqd-node: < 3.1.8 → fixed in 3.1.8

Description

Description There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002. ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt. ISA-2025-002 affects the Cosmos SDK package, where `x/group` can halt when erroring in `EndBlocker`. Impact If unaddressed, this could result in a chain halt. Patches Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References