Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-qv97-5qr8-2266
GHSA-qv97-5qr8-2266:
Rust vulnerability analysis and mitigation
Overview
The vulnerability (GHSA-qv97-5qr8-2266) affects the Mithril network's certification system for Cardano database snapshots. Discovered and disclosed on May 7, 2025, this moderate severity issue impacts the Mithril client library versions below 0.12.2 and Mithril client CLI versions below 0.12.1. The vulnerability exists in the certification process of snapshots used for quickly bootstrapping Cardano nodes, where certain files are excluded from the signature verification process (GitHub Advisory).
Technical details
The vulnerability has a CVSS score of 4.9 (Moderate) with the following characteristics: Network attack vector, High attack complexity, Low privileges required, No user interaction needed, Changed scope, and Low impact on integrity and availability. The technical issue stems from limitations in the certification mechanism where some files are not identically generated across Cardano nodes, and there's no API to provide consistent snapshots at specific beacons on the Cardano chain. Notably, the last immutable file and ledger state files are excluded from the signature verification process (GitHub Advisory).
Impact
The vulnerability could allow inconsistencies to be introduced into tampered ledger states distributed through Mithril snapshots. These inconsistencies might not be immediately detected by Cardano nodes started with such snapshots, potentially enabling long-range attacks that could persist even if nodes sync from genesis. The risk is particularly relevant for future scenarios where Mithril networks become more decentralized with multiple independent aggregators (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched with several version updates: Mithril client library version 0.12.2, Mithril client CLI version 0.12.1, and Mithril aggregator version 0.7.44. The fix implements a new security measure where the Mithril aggregator signs the ledger state snapshot and the latest immutable file using an IOG-owned key, and the client library and CLI validate the signature of these files upon download. Users are advised to upgrade to these patched versions immediately (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management