CVE-2022-23507
Tendermint light client verification not taking into account chain ID
Impact
### Impact Anyone using the `tendermint-light-client` and related packages to perform light client verification (e.g. IBC-rs, Hermes). At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. ### Patches Users of the light client-related crates can currently upgrade to `v0.28.0`. ### Workarounds None ### References - [Light Client specification](https://github.com/tendermint/tendermint/tree/main/spec/light-client)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | tendermint-light-client-verifier | <= 0.27.0 | 0.28.0 |
| rust | tendermint-light-client | <= 0.27.0 | 0.28.0 |
| rust | tendermint-light-client-js | <= 0.27.0 | 0.28.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tendermint-Light-Client-Js Project | Tendermint-Light-Client-Js | before 0.28.0 |
| Tendermint-Light-Client-Verifier Project | Tendermint-Light-Client-Verifier | before 0.28.0 |
| Tendermint-Light-Client Project | Tendermint-Light-Client | before 0.28.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-xqqc-c5gw-c5r5
- https://github.com/advisories/GHSA-xqqc-c5gw-c5r5
- https://github.com/informalsystems/tendermint-rs/commit/5c32f31b97ac3172775699fe0d4ba6003ca4fb18
- https://nvd.nist.gov/vuln/detail/CVE-2022-23507