CRITICAL

GHSA-7fw6-6mfj-g3q2

ckb: Transaction header_deps validation issue (network forking)

Details

### Impact fn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176

It will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.

### Patches

0.101.1 and later versions

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/ckb

Introduced in: 0Fixed in: 0.101.1

Upgrade ckb to 0.101.1 or newer (ecosystem crates.io).

References

https://github.com/nervosnetwork/ckb/security/advisories/GHSA-7fw6-6mfj-g3q2[WEB]
https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176[WEB]
https://github.com/nervosnetwork/ckb[PACKAGE]