{"id":"GHSA-qjcv-rx3v-7mvj","summary":"github.com/cosmos/ibc-go affected by IBC protocol \"Huckleberry\" vulnerability","details":"The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol \"Huckleberry\" vulnerability.","aliases":["GO-2024-2874"],"modified":"2024-05-23T16:07:38Z","published":"2024-05-20T21:51:33Z","database_specific":{"github_reviewed_at":"2024-05-20T21:51:33Z","nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/cosmos/ibc-go/issues/1532"},{"type":"WEB","url":"https://github.com/cosmos/ibc-go/commit/c77f80f812940fe3b93980d13a5cdd6980e907cc"},{"type":"WEB","url":"https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731"},{"type":"PACKAGE","url":"https://github.com/cosmos/ibc-go"},{"type":"WEB","url":"https://github.com/cosmos/ibc-go/releases/tag/v6.1.1"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2023-1860"}],"affected":[{"package":{"name":"github.com/cosmos/ibc-go/v7","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v7"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v6","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v6"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v5","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v5","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.3.0"},{"fixed":"5.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v4","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v4","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.2.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v4","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v4","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v3","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.4.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go/v2","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}},{"package":{"name":"github.com/cosmos/ibc-go","ecosystem":"Go","purl":"pkg:golang/github.com/cosmos/ibc-go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-qjcv-rx3v-7mvj/GHSA-qjcv-rx3v-7mvj.json"}}],"schema_version":"1.9.0"}