Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-86h5-xcpx-cfqc
GHSA-86h5-xcpx-cfqc:
vulnerability analysis and mitigation
Overview
A low severity vulnerability (GHSA-86h5-xcpx-cfqc) was identified in the Cosmos SDK affecting versions <= 0.50.4 and <= 0.47.9. The issue was discovered on December 6, 2023, by cat shark (Khanh) through the Cosmos Bug Bounty Program on HackerOne. The vulnerability affects chain developers, validator, and node operators using the affected versions of the Cosmos SDK (Cosmos Advisory).
Technical details
The vulnerability exists in the slashing mechanism of the Cosmos SDK, specifically related to the re-delegation process. The issue allows for potential evasion of slashing penalties during a slashing event through manipulation of re-delegation behavior. The vulnerability is classified with CWE-372 and has been assigned a low severity rating (Cosmos Advisory).
Impact
If exploited, the vulnerability allows delegations that contributed to byzantine behavior of a validator to potentially evade pending slashing penalties. This evasion is possible when the validator has not yet been slashed, and the delegation uses specific re-delegation patterns to avoid the penalty (Cosmos Advisory).
Mitigation and workarounds
The issue has been patched in Cosmos SDK versions 0.50.5 and 0.47.10. Chain developers using affected versions are advised to update to the latest available version of the Cosmos SDK. Network operators are recommended to upgrade once a patched version is available. Additional validation logic has been implemented to restrict the problematic re-delegation behavior (Cosmos Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management