Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

tendermint-light-client

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4crates.ioPublished

    Tendermint light client verification not taking into account chain ID

    CVE-2022-23507 · GHSA-xqqc-c5gw-c5r5

    Affected
    • crates.io tendermint-light-client <= 0.27.0
    Fixed in
    0.28.0· Vendor fix available
    Issue
    Impact Anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. Patches Users of the light client-related crates can currently upgrade to v0.28.0. Workarounds None References - Light Client specification

    Recommended action: Upgrade to 0.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →