NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹 Go
Not in CISA KEV

cheqd-node subject to Cosmos SDK "Barberry" vulnerabilityGHSA-8qxh-2gh8-r923

GHSA-8qxh-2gh8-r923 is a security vulnerability in github.com/cheqd/cheqd-node. A fix is available for github.com/cheqd/cheqd-node — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Jun 12, 2023 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐹github.com/cheqd/cheqd-node

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

This vulnerability dubbed "Barberry" affects the Cosmos SDK framework used by cheqd-node as base.

It impacts the way Cosmos SDK handles vesting accounts, and can therefore be a high-impact vulnerability for any network running the framework.

There is no vulnerability in the DID/resource modules for cheqd-node.

Patches

Node operators are requested to upgrade to cheqd-node v1.4.4. This is not a state-breaking release and does not require a coordinated upgrade across all node operators.

This vulnerability was patched in Cosmos SDK v0.46.13. Since this version switches to Go v1.19 and also changes the namespace of many Cosmos protobuf packages, the Barberry fix was backported to cheqd's fork of Cosmos SDK.

Mitigation

When at least ~33% of the voting power of the network has deployed the recommended version of the software, any attack would be unsuccessful but cause a chain halt.

Once at least ~67% of the voting power of the network has deployed recommended version of the software, the attack would be unsuccessful without a chain halt.

Workarounds

No. Node operators are recommended to upgrade to the latest release version.

References

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/cheqd/cheqd-nodeall versions1.4.4go get github.com/cheqd/cheqd-node@v1.4.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/cheqd/cheqd-node, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/cheqd/cheqd-node to 1.4.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8qxh-2gh8-r923 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact This [vulnerability dubbed "Barberry" affects the Cosmos SDK framework](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) used by `cheqd-node` as base. It impacts the way Cosmos SDK handles vesting accounts, and can therefore be a high-impact vulnerability for any network running the framework. There is no vulnerability in the DID/resource modules for `cheqd-node`. ### Patches Node operators are requested to upgrade to [cheqd-node v1.4.4](https://github.com/cheqd/cheqd-node/releases/tag/v1.4.4). This is not a state-breaking release and does not require a
O3 Security · Impact-Aware SCA

Is GHSA-8qxh-2gh8-r923 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
cheqd-node subject to Cosmos SDK "Barberry" vulnerability