GCVE - cpe:2.3:a:tendermint-light-client-verifier_project:tendermint-light-client-verifier:*:*:*:*:*:rust:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tendermint-light-client-verifier_project:tendermint-light-client-verifier:*:*:*:*:*:rust:*:*

part: a version: * update: *

Vendor	Tendermint Light Client Verifier Project (`0f78594c-0be5-5aeb-9de6-ccdeccc73735`)
Product	Tendermint Light Client Verifier (`030a00e2-3054-5fbe-bea4-52d97c90f5b1`)
Edition	*
Language	*
Software edition	*
Target software	rust
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-23507`	vulnerable	2026-06-08 05:40:57.663423	Light client verification not taking into account chain ID MEDIUM (5.4) Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. This issue is patched in version 0.28.0. There are no workarounds. Published: 2022-12-15T00:01:04.540Z Updated: 2025-04-18T15:59:54.978Z Open on db.gcve.eu Reference links https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-xqqc-c5gw-c5r5	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.