Skip to content

Commit be75657

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add GO-2025-3494
 - data/reports/GO-2025-3494.yaml Fixes #3494 Change-Id: Ibea166530aeb5274c5e1fe4976ad3459c1047761 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/654295 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Neal Patel <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> Commit-Queue: Neal Patel <[email protected]>
1 parent a5c443c commit be75657

File tree

2 files changed

+210
-0
lines changed

2 files changed

+210
-0
lines changed

‎data/osv/GO-2025-3494.json

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3494",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-jg6f-48ff-5xrw"
8+
],
9+
"summary": "IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go",
10+
"details": "IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cosmos/ibc-go",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/cosmos/ibc-go/v2",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
}
41+
]
42+
}
43+
],
44+
"ecosystem_specific": {}
45+
},
46+
{
47+
"package": {
48+
"name": "github.com/cosmos/ibc-go/v3",
49+
"ecosystem": "Go"
50+
},
51+
"ranges": [
52+
{
53+
"type": "SEMVER",
54+
"events": [
55+
{
56+
"introduced": "0"
57+
}
58+
]
59+
}
60+
],
61+
"ecosystem_specific": {}
62+
},
63+
{
64+
"package": {
65+
"name": "github.com/cosmos/ibc-go/v4",
66+
"ecosystem": "Go"
67+
},
68+
"ranges": [
69+
{
70+
"type": "SEMVER",
71+
"events": [
72+
{
73+
"introduced": "0"
74+
}
75+
]
76+
}
77+
],
78+
"ecosystem_specific": {}
79+
},
80+
{
81+
"package": {
82+
"name": "github.com/cosmos/ibc-go/v5",
83+
"ecosystem": "Go"
84+
},
85+
"ranges": [
86+
{
87+
"type": "SEMVER",
88+
"events": [
89+
{
90+
"introduced": "0"
91+
}
92+
]
93+
}
94+
],
95+
"ecosystem_specific": {}
96+
},
97+
{
98+
"package": {
99+
"name": "github.com/cosmos/ibc-go/v6",
100+
"ecosystem": "Go"
101+
},
102+
"ranges": [
103+
{
104+
"type": "SEMVER",
105+
"events": [
106+
{
107+
"introduced": "0"
108+
}
109+
]
110+
}
111+
],
112+
"ecosystem_specific": {}
113+
},
114+
{
115+
"package": {
116+
"name": "github.com/cosmos/ibc-go/v7",
117+
"ecosystem": "Go"
118+
},
119+
"ranges": [
120+
{
121+
"type": "SEMVER",
122+
"events": [
123+
{
124+
"introduced": "0"
125+
},
126+
{
127+
"fixed": "7.9.2"
128+
}
129+
]
130+
}
131+
],
132+
"ecosystem_specific": {}
133+
},
134+
{
135+
"package": {
136+
"name": "github.com/cosmos/ibc-go/v8",
137+
"ecosystem": "Go"
138+
},
139+
"ranges": [
140+
{
141+
"type": "SEMVER",
142+
"events": [
143+
{
144+
"introduced": "0"
145+
},
146+
{
147+
"fixed": "8.6.1"
148+
}
149+
]
150+
}
151+
],
152+
"ecosystem_specific": {}
153+
}
154+
],
155+
"references": [
156+
{
157+
"type": "ADVISORY",
158+
"url": "https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw"
159+
},
160+
{
161+
"type": "FIX",
162+
"url": "https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748"
163+
},
164+
{
165+
"type": "FIX",
166+
"url": "https://github.com/cosmos/ibc-go/commit/9869b3c6f7eb05a935b1eb33611c5406f68438a5"
167+
}
168+
],
169+
"database_specific": {
170+
"url": "https://pkg.go.dev/vuln/GO-2025-3494",
171+
"review_status": "REVIEWED"
172+
}
173+
}

‎data/reports/GO-2025-3494.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: GO-2025-3494
2+
modules:
3+
- module: github.com/cosmos/ibc-go
4+
vulnerable_at: 1.5.0
5+
- module: github.com/cosmos/ibc-go/v2
6+
vulnerable_at: 2.5.0
7+
- module: github.com/cosmos/ibc-go/v3
8+
vulnerable_at: 3.4.0
9+
- module: github.com/cosmos/ibc-go/v4
10+
vulnerable_at: 4.6.0
11+
- module: github.com/cosmos/ibc-go/v5
12+
vulnerable_at: 5.4.0
13+
- module: github.com/cosmos/ibc-go/v6
14+
vulnerable_at: 6.3.1
15+
- module: github.com/cosmos/ibc-go/v7
16+
versions:
17+
- fixed: 7.9.2
18+
vulnerable_at: 7.9.1
19+
- module: github.com/cosmos/ibc-go/v8
20+
versions:
21+
- fixed: 8.6.1
22+
vulnerable_at: 8.6.0
23+
summary: |-
24+
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in
25+
github.com/cosmos/ibc-go
26+
ghsas:
27+
- GHSA-jg6f-48ff-5xrw
28+
references:
29+
- advisory: https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw
30+
- fix: https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748
31+
- fix: https://github.com/cosmos/ibc-go/commit/9869b3c6f7eb05a935b1eb33611c5406f68438a5
32+
notes:
33+
- advisory lists v7,v8 as vulnerable and <v7 as potentially vulnerable with no fixes
34+
source:
35+
id: GHSA-jg6f-48ff-5xrw
36+
created: 2025-03-03T10:55:32.377798-05:00
37+
review_status: REVIEWED

0 commit comments

Comments
 (0)