Cosmos-SDK Security Advisory Pineapple

Recently, the core Cosmos development team became aware of a potential security vulnerability impacting IBC in Cosmos-SDK 0.42.x and ibc-go v1.x.x and v2.x.x. The bug appears to be low-severity in general but may be high-severity depending on the design of certain modules. User funds in accounts and staking delegations are NOT at risk; however, the vulnerability may result in unexpected behavior for certain modules. We encourage all chains using Cosmos-SDK v0.42.x with IBC enabled or Cosmos-SDK 0.44.x/0.45.x with ibc-go in production to upgrade as soon as possible. Chains interested in inspecting the patch to determine if any of their modules may be adversely affected by the bug, please contact the IBC team at Interchain GmbH in the ibc-core channel on the Cosmos Discord . We can provide support to help decide when to upgrade. Note the patch is state-machine breaking. Thus validators must coordinate to upgrade at the same height to avoid the risk of a consensus failure if the bug is triggered before all nodes have upgraded. This also means that if the bug was triggered already in the past, the upgraded software may reject blocks when syncing from a historical point. While…

Excerpt (1196 of 2297 characters). Read the whole post on the forum ↗

The patches that resolve the issues comprising Security Advisory Pineapple have been released in v1.3.0, v1.4.0, v2.1.0 and v2.2.0 of ibc-go. All releases are now available to the public.

A full timeline of the vulnerability disclosure and coordination activities that comprise this release should be available by Tuesday, March 22.

You can find the releases available on the ibc-go’s releases page.

Again, an upgrade for the Cosmos Hub thus does not appear necessary at this time.

thank you for this. It’s a lot of work to keep track of these matters.