What is GHSA-xqqc-c5gw-c5r5?

GHSA-xqqc-c5gw-c5r5 is a security advisory published by GitHub Security Advisories with Medium severity. Tendermint light client verification not taking into account chain ID

Which CVE IDs does GHSA-xqqc-c5gw-c5r5 cover?

GHSA-xqqc-c5gw-c5r5 covers the following CVE IDs: CVE-2022-23507. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xqqc-c5gw-c5r5?

GHSA-xqqc-c5gw-c5r5 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-xqqc-c5gw-c5r5?

GHSA-xqqc-c5gw-c5r5 affects 3 products, including: rust/tendermint-light-client-verifier:\u003c= 0.27.0; rust/tendermint-light-client:\u003c= 0.27.0; rust/tendermint-light-client-js:\u003c= 0.27.0.

GHSA-xqqc-c5gw-c5r5MediumCVSS 5.4

Tendermint light client verification not taking into account chain ID

Vendor

GitHub Security Advisories

Published

December 14, 2022

Last Modified

January 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-23507 →

📋 Description

Impact

Anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes).

At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client.

The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks.

Patches

Users of the light client-related crates can currently upgrade to v0.28.0.

Workarounds

None

References

Light Client specification

🎯 Affected products3

rust/tendermint-light-client-verifier:<= 0.27.0
rust/tendermint-light-client:<= 0.27.0
rust/tendermint-light-client-js:<= 0.27.0