Read the docs
TI-2023-30742 Aliases GHSA-7c94-gvvj-r3mg

cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact This vulnerability affects the [`ibc-go` package for those running full nodes, dubbed "Huckleberry"](https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731). According to their advisory: > This issue is low-severity in general, and it has a low impact and likelihood of exploitation. Depending on how a full node is architected, this issue could potentially yield a high or critical severity vulnerability. There is no vulnerability in the DID/resource modules for cheqd-node. ### Patches Node operators are requested to upgrade to [cheqd-node v1.4.2](https://github.com/cheqd/cheqd-node/releases/tag/v1.4.2). This is a non-state breaking release, and does not require a coordinated upgrade across all node operators. ### Workarounds No. Node operators are recommended to upgrade to the latest release version. ### References - ["Huckleberry" IBC security advisory](https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731) - [`ibc-go` v6.1.1 release notes](https://github.com/cosmos/ibc-go/releases/tag/v6.1.1)

Why it matters now

Fix Fixed github.com/cheqd/cheqd-node (Go): 1.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/cheqd/cheqd-node (Go)before 1.4.21.4.2Patch availableGHSA-7c94-gvvj-r3mg
  • github.com/cheqd/cheqd-node (Go) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-7c94-gvvj-r3mg

Remediation

  • Fix · GHSA-7c94-gvvj-r3mg github.com/cheqd/cheqd-node (Go) Fixed in 1.4.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7c94-gvvj-r3mg

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences