GHSA-47ww-ff84-4jrg: Cosmos SDK: x/group can halt when erroring in EndBlocker

March 12, 2025

Name: ISA-2025-002: x/group can halt when erroring in EndBlocker Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: <= v0.47.16, <= 0.50.12 Affected users: Validators, Full nodes, Users on chains that utilize the groups module Cosmos SDK chains in unpatched releases that use the x/group module are affected.

References

github.com/advisories/GHSA-47ww-ff84-4jrg
github.com/cosmos/cosmos-sdk
github.com/cosmos/cosmos-sdk/commit/cbd69fb1f4fac418c1f8c6253f5f91fb1263776a
github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg

Code Behaviors & Features

Detect and mitigate GHSA-47ww-ff84-4jrg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →