Read the docs
TI-2023-30761 Aliases GHSA-j2cr-jc39-wpx5

Barberry Security Advisory - regarding x/auth periodic vesting accounts

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact In `PeriodicVestingAccount`, defined in `x/auth`, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able to withdraw them. ### Patches \>= v0.46.13 for Cosmos SDK v0.46.x \>= v0.47.3 for Cosmos SDK v0.47.x If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too. ### Workarounds There is no workaround for this issue. Upgrade immediately. ### References * Patched versions release notes: [v0.47.3](https://github.com/cosmos/cosmos-sdk/blob/cfc757dc5043fb2758c47c146d2912fd010c1a45/RELEASE_NOTES.md#cosmos-sdk-v0473-release-notes), [v0.46.13](https://github.com/cosmos/cosmos-sdk/blob/d4b7164de5d8391e6aa644d8ea84e07396dd9653/RELEASE_NOTES.md#cosmos-sdk-v04613-release-notes). * [Forum Post](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825)

Why it matters now

Fix Fixed github.com/cosmos/cosmos-sdk (Go): 0.46.13, 0.47.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/cosmos/cosmos-sdk (Go)0.46.0 to before 0.46.130.46.13Patch availableGHSA-j2cr-jc39-wpx5
—github.com/cosmos/cosmos-sdk (Go)0.47.0 to before 0.47.30.47.3Patch availableGHSA-j2cr-jc39-wpx5
  • github.com/cosmos/cosmos-sdk (Go) Vendor— Affected 0.46.0 to before 0.46.13 Fixed in 0.46.13 Patch available GHSA-j2cr-jc39-wpx5
  • github.com/cosmos/cosmos-sdk (Go) Vendor— Affected 0.47.0 to before 0.47.3 Fixed in 0.47.3 Patch available GHSA-j2cr-jc39-wpx5

Remediation

  • Fix · GHSA-j2cr-jc39-wpx5 github.com/cosmos/cosmos-sdk (Go) Fixed in 0.46.13 Advisory →
  • Fix · GHSA-j2cr-jc39-wpx5 github.com/cosmos/cosmos-sdk (Go) Fixed in 0.47.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-j2cr-jc39-wpx5

References

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences