GHSA-8qxh-2gh8-r923: Github.com/cheqd/cheqd node Cheqd-node Subject To Cosmos SDK Vulnerability

HIGH
Share
Published
Advisory Summary

GHSA-8qxh-2gh8-r923 is a HIGH cheqd-node subject to cosmos sdk vulnerability (General Security Weakness) affecting Github.com/cheqd/cheqd node libraries in the Go ecosystem. The issue involves cheqd-node subject to cosmos sdk "barberry" vulnerability. Remediation is available by upgrading affected packages to version 1.4.4.

GHSA-8qxh-2gh8-r923 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-8qxh-2gh8-r923
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Github.com/cheqd/cheqd node
Package Ecosystem Go
Published Date
Last Updated

How to Fix GHSA-8qxh-2gh8-r923

To remediate this vulnerability, upgrade all affected Github.com/cheqd/cheqd node dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/cheqd/cheqd-node fixed: 1.4.4 
Upgrade github.com/cheqd/cheqd-node to 1.4.4
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/cheqd/cheqd-node

How to Check if You Are Affected

To determine whether your application is affected by GHSA-8qxh-2gh8-r923, inspect your project dependencies for Github.com/cheqd/cheqd node:

inspect dependencies for github.com/cheqd/cheqd-node

Analyze the terminal output to locate any version of Github.com/cheqd/cheqd node in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Github.com/cheqd/cheqd node, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact This [vulnerability dubbed "Barberry" affects the Cosmos SDK framework](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) used by `cheqd-node` as base. It impacts the way Cosmos SDK handles vesting accounts, and can therefore be a high-impact vulnerability for any network running the framework. There is no vulnerability in the DID/resource modules for `cheqd-node`. ### Patches Node operators are requested to upgrade to [cheqd-node v1.4.4](https://github.com/cheqd/cheqd-node/releases/tag/v1.4.4). This is not a state-breaking release and does not require a coordinated upgrade across all node operators. This vulnerability was patched in [Cosmos SDK v0.46.13](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13). Since this version switches to Go v1.19 and also changes the namespace of many Cosmos protobuf packages, the Barberry fix was [backported to cheqd's fork of Cosmos SDK](https://github.com/cheqd/cosmos-sdk/releases/tag/v0.46.10-barberry). ### Mitigation When at least ~**33**% of the voting power of the network has deployed the recommended version of the software, any attack would be unsuccessful but cause a chain halt. Once at least ~**67**% of the voting power of the network has deployed recommended version of the software, the attack would be unsuccessful _without_ a chain halt. ### Workarounds No. Node operators are recommended to upgrade to the latest release version. ### References - ["Barberry" vulnerability security advisory](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) - [Cosmos SDK v0.46.13 release notes](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13)

GHSA-8qxh-2gh8-r923 Affected Github.com/cheqd/cheqd node Versions

1 component(s)
Fixed Versions:
1.4.4
Product / Package Ecosystem Affected Versions Fixed Version
github.com/cheqd/cheqd-node
golang/github.com/cheqd/cheqd-node
Go
< 1.4.4
1.4.4

References

GitHub Advisory / Wiki ADVISORY
https://github.com/cheqd/cheqd-node/security/advisories/GHSA-8qxh-2gh8-r923
Github.com/cheqd/cheqd node Security Information SECURITY
https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825
Github.com/cheqd/cheqd node Source Repository REPOSITORY
https://github.com/cheqd/cheqd-node
Github.com/cheqd/cheqd node Release RELEASE
https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13

Frequently Asked Questions

What is GHSA-8qxh-2gh8-r923?
GHSA-8qxh-2gh8-r923 is a security vulnerability in Github.com/cheqd/cheqd node involving cheqd-node subject to Cosmos SDK "Barberry" vulnerability under General Security Weakness.
Which Github.com/cheqd/cheqd node versions are affected?
Affected versions include releases prior to 1.4.4 across affected packages: github.com/cheqd/cheqd-node.
What version fixes GHSA-8qxh-2gh8-r923?
Upgrading to 1.4.4 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/cheqd/cheqd-node affected?
Yes, github.com/cheqd/cheqd-node is affected in releases prior to 1.4.4. Upgrade your dependency to 1.4.4 or later.
What CWE is associated with GHSA-8qxh-2gh8-r923?
GHSA-8qxh-2gh8-r923 is classified under General Security Weakness.
How can I check Go dependencies for GHSA-8qxh-2gh8-r923?
Run the dependency tree command: 'inspect dependencies for github.com/cheqd/cheqd-node'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8qxh-2gh8-r923",
  "modified" : "2023-06-12T18:34:26Z",
  "published" : "2023-06-12T18:34:26Z",
  "aliases" : [ ],
  "summary" : "cheqd-node subject to Cosmos SDK \"Barberry\" vulnerability",
  "details" : "### Impact\nThis [vulnerability dubbed \"Barberry\" affects the Cosmos SDK framework](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) used by `cheqd-node` as base.\n\nIt impacts the way Cosmos SDK handles vesting accounts, and can therefore be a high-impact vulnerability for any network running the framework.\n\nThere is no vulnerability in the DID/resource modules for `cheqd-node`.\n\n### Patches\nNode operators are requested to upgrade to [cheqd-node v1.4.4](https://github.com/cheqd/cheqd-node/releases/tag/v1.4.4). This is not a state-breaking release and does not require a coordinated upgrade across all node operators.\n\nThis vulnerability was patched in [Cosmos SDK v0.46.13](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13). Since this version switches to Go v1.19 and also changes the namespace of many Cosmos protobuf packages, the Barberry fix was [backported to cheqd's fork of Cosmos SDK](https://github.com/cheqd/cosmos-sdk/releases/tag/v0.46.10-barberry).\n\n### Mitigation\nWhen at least ~**33**% of the voting power of the network has deployed the recommended version of the software, any attack would be unsuccessful but cause a chain halt.\n\nOnce at least ~**67**% of the voting power of the network has deployed recommended version of the software, the attack would be unsuccessful _without_ a chain halt.\n\n### Workarounds\nNo. Node operators are recommended to upgrade to the latest release version.\n\n### References\n- [\"Barberry\" vulnerability security advisory](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825)\n- [Cosmos SDK v0.46.13 release notes](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13)\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cheqd/cheqd-node"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.4.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cheqd/cheqd-node/security/advisories/GHSA-8qxh-2gh8-r923"
  }, {
    "type" : "WEB",
    "url" : "https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cheqd/cheqd-node"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-06-12T18:34:26Z",
    "nvd_published_at" : null
  }
}