MEDIUM6.5
GHSA-2p6r-37p9-89p2
Authz Module Non-Determinism
Quick fix
GHSA-2p6r-37p9-89p2 — github.com/cosmos/cosmos-sdk: upgrade to the fixed version with the command below.
go get github.com/cosmos/cosmos-sdk@v0.44.2Details
### Impact
Consensus failure for 0.43.x and 0.44.{0,1} users. Funds and balances are safe.
### Patches
0.44.2
### Workarounds
Manually patch the code.
---
Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/cosmos/cosmos-sdk
Introduced in:
0.43.0Fixed in: 0.44.2Fix
go get github.com/cosmos/cosmos-sdk@v0.44.2References
- https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2p6r-37p9-89p2[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2021-41135[ADVISORY]
- https://github.com/cosmos/cosmos-sdk/commit/68ab790a761e80d3674f821794cf18ccbfed45ee[WEB]
- https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349[WEB]
- https://github.com/cosmos/cosmos-sdk[PACKAGE]
- https://github.com/cosmos/cosmos-sdk/releases/tag/v0.44.2[WEB]