Digest · Friday
Security digest: February 28, 2025
1 critical advisory.
All digests · RSS · Markdown
Take stock
- Go: 1 critical advisory (
github.com/cosmos/ibc-go,github.com/cosmos/ibc-go/v2,github.com/cosmos/ibc-go/v3,github.com/cosmos/ibc-go/v4,github.com/cosmos/ibc-go/v5,github.com/cosmos/ibc-go/v6,github.com/cosmos/ibc-go/v7,github.com/cosmos/ibc-go/v8). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 1
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-jg6f-48ff-5xrw CVSS 9.3 Critical
github.com/cosmos/ibc-go< 7.9.2 → no fix listed;github.com/cosmos/ibc-go/v2< 7.9.2 → no fix listed;github.com/cosmos/ibc-go/v3< 7.9.2 → no fix listed; +5 more packages