CVE-2022-23507

The CVE concerns Tendermint’s light-client verification prior to version 0.28.0, where the light client does not verify that the trusted and untrusted chain IDs match during header verification. This can allow a header from an untrusted chain that passes other checks (e.g., overlapping validator ...