GHSA-h2rp-8vpx-q9r4: cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)
There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.
ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.
ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.
References
- github.com/advisories/GHSA-h2rp-8vpx-q9r4
- github.com/cheqd/cheqd-node
- github.com/cheqd/cheqd-node/commit/5a58b08dfb8dfc24631fb85b641cb75e9178d07f
- github.com/cheqd/cheqd-node/releases/tag/v3.1.8
- github.com/cheqd/cheqd-node/security/advisories/GHSA-h2rp-8vpx-q9r4
- github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg
- github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v
Code Behaviors & Features
Detect and mitigate GHSA-h2rp-8vpx-q9r4 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →