GHSA-XQQC-C5GW-C5R5 Tendermint light client verification not taking into account chain ID

Impact Anyone using the tendermint-light-client and related packages to perform light client verification e.g. IBC-rs, Hermes. At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a...

Tendermint light client verification not taking into account chain ID

Impact Anyone using the tendermint-light-client and related packages to perform light client verification e.g. IBC-rs, Hermes. At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a...

PT-2022-16039 · Unknown · Tendermint

Name of the Vulnerable Software and Affected Versions: Tendermint versions prior to 0.28.0 Description: The issue concerns a potential attack via improper verification of cryptographic signatures, affecting users of the tendermint-light-client and related packages for light client verification. T...