CVE-2022-23507 json
Light client verification not taking into account chain ID
published 2022-12-14 3 y ago modified 2026-06-17 4 mo ago also GHSA-xqqc-c5gw-c5r5 , EUVD-2022-7774
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. This issue is patched in version 0.28.0. There are no workarounds.
Patch / fix
- crates.io tendermint-light-client-verifier 0.28.0
- crates.io tendermint-light-client 0.28.0
- crates.io tendermint-light-client-js 0.28.0
- tendermint-light-client-js_project tendermint-light-client-js 0.28.0
- tendermint-light-client-verifier_project tendermint-light-client-verifier 0.28.0
- tendermint-light-client_project tendermint-light-client 0.28.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | tendermint-light-client-verifier | <0.28.0 |
0.28.0 |
| crates.io | tendermint-light-client | <0.28.0 |
0.28.0 |
| crates.io | tendermint-light-client-js | <0.28.0 |
0.28.0 |
Affected products
- informalsystems tendermint-rs
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
github.com
/informalsystems/tendermint-rs/commit/5c32f31b97ac3172775699fe0d4ba6003ca4fb18
web
-
github.com
/informalsystems/tendermint-rs/security/advisories/GHSA-xqqc-c5gw-c5r5
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-23507
advisory
-
github.com
/informalsystems/tendermint-rs
package
Sources
- CVE List CVE-2022-23507
- GitHub Advisory GHSA-xqqc-c5gw-c5r5
- NVD CVE-2022-23507
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.