Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade Ibc-go to address ASA-2024-007 #9205

Closed
ivanlei opened this issue Apr 8, 2024 · 1 comment · Fixed by #9341
Closed

Upgrade Ibc-go to address ASA-2024-007 #9205

ivanlei opened this issue Apr 8, 2024 · 1 comment · Fixed by #9341
Assignees
@LuqiPan
Labels
agoric-cosmos enhancement New feature or request

Comments

@ivanlei
Copy link
Contributor

ivanlei commented Apr 8, 2024 •
edited by LuqiPan

What is the Problem Being Solved?

ASA-2024-007 describes a vulnerability in the version of IBC used by the Agoric chain. There are no known ways to exploit this vulnerability on the Agoric chain. However, to ensure we're ready for rapid deployment of fixes, let's apply this change to the master branch of agoric-sdk.

Description of the Design

Simple patch to bump version in https://github.com/Agoric/agoric-sdk/blob/master/golang/cosmos/go.mod

Security Considerations

This is a hardening measure

Scaling Considerations

No known impact to scaling

Test Plan

Please testing CI as well as using /golang/cosmos/e2e_test

Upgrade Considerations

This should go out in upgrade16 regardless of whatever other Interchain Stack changes go out.
@ivanlei ivanlei added enhancement New feature or request agoric-cosmos labels Apr 8, 2024
@LuqiPan
Copy link
Contributor

LuqiPan commented May 8, 2024

Note: there is a new release in v6.3.x release line tagged v6.3.1 that seems to be specifically for Celestia to address some of their maintenance/testing(?) need.

Given the note above, we'll still target upgrading to v6.3.0 as suggested in ASA-2024-007

@LuqiPan LuqiPan mentioned this issue May 8, 2024
Merged
1 task
@mergify mergify bot closed this as completed in #9341 May 14, 2024
mergify bot pushed a commit that referenced this issue May 14, 2024
@LuqiPan
deps(go): use cosmos/ibc-go v6.3.0 (#9341)
6b5e706 
<!-- < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < ☺
v                               ✰  Thanks for creating a PR! ✰
☺ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >  -->

<!-- Most PRs should close a specific Issue. All PRs should at least
reference one or more Issues. Edit and/or delete the following lines as
appropriate (note: you don't need both `refs` and `closes` for the same
one): -->

closes: #9205
refs: #9205

## Description

This PR updates ibc-go in response to
GHSA-j496-crgh-34mx

TODO
- [x] upgrade our runbook with a note on async channel version
negotiation

### Security Considerations

This PR addresses
GHSA-j496-crgh-34mx

### Scaling Considerations

N/A

### Documentation Considerations

N/A

### Testing Considerations

Relying on our CI/CD to verify things as this is a simple dependency
version bump

### Upgrade Considerations

N/A
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@LuqiPan LuqiPan

Labels
agoric-cosmos enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

deps(go): use cosmos/ibc-go v6.3.0 Agoric/agoric-sdk
2 participants
@ivanlei @LuqiPan