GitHub Advisoryadvisory · crates.io

GHSA-xqqc-c5gw-c5r5 Tendermint light client verification not taking into account chain ID

MEDIUM Published 2022-12-14 Modified 2022-12-14 Official page ↗
Aliases
CVE-2022-23507
Ecosystem
crates.io
Packages
tendermint-light-client-verifier, tendermint-light-client, tendermint-light-client-js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-347
Reviewed
2022-12-14

Affected packages

• crates.io tendermint-light-client-verifier: < 0.28.0 → fixed in 0.28.0 • crates.io tendermint-light-client: < 0.28.0 → fixed in 0.28.0 • crates.io tendermint-light-client-js: < 0.28.0 → fixed in 0.28.0

Description

Impact Anyone using the `tendermint-light-client` and related packages to perform light client verification (e.g. IBC-rs, Hermes). At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. Patches Users of the light client-related crates can currently upgrade to `v0.28.0`. Workarounds None References • Light Client specification

Related

Alias · CVE (1)

  • CVE-2022-23507 Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References