CVE-2022-23507

The CVE concerns Tendermint’s light-client verification prior to version 0.28.0, where the light client does not verify that the trusted and untrusted chain IDs match during header verification. This can allow a header from an untrusted chain that passes other checks (e.g., overlapping validator ...

CVE-2022-23507 Light client verification not taking into account chain ID

Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform ligh...

ibc (>=0.11.0, <=0.19.0), ibc-relayer (>=0.11.0, <=0.19.0) +6 more potentially affected by CVE-2022-23507 via tendermint-light-client-verifier (>=0.23.5, <=0.27.0)

tendermint-light-client-verifier CARGO version =0.23.5, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.15.0, =0.23.5, =0.23.0, =0.27.0 Source cves: CVE-2022-23507 Source advisory: OSV:GHSA-XQQC-C5GW-C5R5...

ibc (>=0.0.6, <=0.10.0), ibc-relayer (>=0.1.0, <=0.19.0) +6 more potentially affected by CVE-2022-23507 via tendermint-light-client (>=0.16.0, <=0.23.9)

tendermint-light-client CARGO version =0.16.0, =0.0.6, =0.1.0, =0.1.0, =0.7.0, =0.8.0-pre.1, =0.15.0, =0.19.0, =0.16.0, =0.19.0 Source cves: CVE-2022-23507 Source advisory: OSV:GHSA-XQQC-C5GW-C5R5...