Skip to content

fix(deps): update module github.com/tendermint/tendermint to v0.33.6 [security] - #4

Open
p2p-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-tendermint-tendermint-vulnerability
Open

fix(deps): update module github.com/tendermint/tendermint to v0.33.6 [security]#4
p2p-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-tendermint-tendermint-vulnerability

Conversation

@p2p-renovate

@p2p-renovate p2p-renovate Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/tendermint/tendermint v0.33.4 → v0.33.6 age confidence

Denial of Service in TenderMint

CVE-2020-15091 / GHSA-6jqj-f58p-mrw3

More information

Details

Description

Denial of Service

Tendermint 0.33.0 and above allow block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it without changing the chainID. (It is a misconfiguration to reuse chainIDs.) Correct block proposers will accidentally include signatures for the wrong block if they see these signatures, and then commits won't validate, making all proposed blocks invalid. A malicious validator (even with a minimal amount of stake) can use this vulnerability to completely halt the network.

Tendermint 0.33.6 checks all the signatures are for the block with +2/3 majority before creating a commit.

False Witness

Tendermint 0.33.1 and above are no longer fully verifying commit signatures during block execution - they stop after +2/3. This means proposers can propose blocks that contain valid +2/3 signatures and then the rest of the signatures can be whatever they want. They can claim that all the other validators signed just by including a CommitSig with arbitrary signature data. While this doesn't seem to impact safety of Tendermint per se, it means that Commits may contain a lot of invalid data **.

** This was already true of blocks, since they could include invalid txs filled with garbage, but in that case the application knew that they are invalid and could punish the proposer. But since applications didn't--and don't-- verify commit signatures directly (they trust Tendermint to do that), they won't be able to detect it.

This can impact incentivization logic in the application that depends on the LastCommitInfo sent in BeginBlock, which includes which validators signed. For instance, Gaia incentivizes proposers with a bonus for including more than +2/3 of the signatures. But a proposer can now claim that bonus just by including arbitrary data for the final -1/3 of validators without actually waiting for their signatures. There may be other tricks that can be played because of this.

Tendermint 0.33.6 verifies all the signatures during block execution ***.

*** Please note that the light client does not check nil votes and exits as soon as 2/3+ of the signatures are checked.

Impact
  • All nodes
  • The network stops due to having a commit with a wrong signature.
Patches
  • v0.33.6 andn v0.34.0-dev1.0.20200702134149-480b995a3172
Workarounds

No workarounds.

References
For more information

If you have any questions or comments about this advisory:

More information can be found here.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

tendermint/tendermint (github.com/tendermint/tendermint)

v0.33.6

Compare Source

July 2, 2020

This security release fixes:

Denial of service

Tendermint 0.33.0 and above allow block proposers to include signatures for the
wrong block. This may happen naturally if you start a network, have it run for
some time and restart it without changing the chainID. (It is a
misconfiguration
to reuse chainIDs.) Correct block proposers will accidentally include signatures
for the wrong block if they see these signatures, and then commits won't validate,
making all proposed blocks invalid. A malicious validator (even with a minimal
amount of stake) can use this vulnerability to completely halt the network.

Tendermint 0.33.6 checks all the signatures are for the block with +2/3
majority before creating a commit.

False Witness

Tendermint 0.33.1 and above are no longer fully verifying commit signatures
during block execution - they stop after +2/3. This means proposers can propose
blocks that contain valid +2/3 signatures and then the rest of the signatures
can be whatever they want. They can claim that all the other validators signed
just by including a CommitSig with arbitrary signature data. While this doesn't
seem to impact safety of Tendermint per se, it means that Commits may contain a
lot of invalid data.

This was already true of blocks, since they could include invalid txs filled
with garbage, but in that case the application knew that they are invalid and
could punish the proposer. But since applications didn't--and don't--
verify commit signatures directly (they trust Tendermint to do that),
they won't be able to detect it.

This can impact incentivization logic in the application that depends on the
LastCommitInfo sent in BeginBlock, which includes which validators signed. For
instance, Gaia incentivizes proposers with a bonus for including more than +2/3
of the signatures. But a proposer can now claim that bonus just by including
arbitrary data for the final -1/3 of validators without actually waiting for
their signatures. There may be other tricks that can be played because of this.

Tendermint 0.33.6 verifies all the signatures during block execution.

Please note that the light client does not check nil votes and exits as soon
as 2/3+ of the signatures are checked.

All clients are recommended to upgrade.

Special thanks to @​njmurarka at Bluzelle Networks for reporting this.

SECURITY:
  • [consensus] Do not allow signatures for a wrong block in commits (@​ebuchman)
  • [consensus] Verify all the signatures during block execution (@​melekes)

Please note that the fix for the False Witness issue renames the VerifyCommitTrusting
function to VerifyCommitLightTrusting. If you were relying on the light client, you may
need to update your code.

v0.33.5

Compare Source

May 28, 2020

Special thanks to external contributors on this release: @​tau3,

BREAKING CHANGES:

  • Go API

    • [privval] #​4744 Remove deprecated OldFilePV (@​melekes)
    • [mempool] #​4759 Modify Mempool#InitWAL to return an error (@​melekes)
    • [node] #​4832 ConfigureRPC returns an error (@​melekes)
    • [rpc] #​4836 Overhaul lib folder (@​melekes)
      Move lib/ folder to jsonrpc/.
      Rename:
      rpc package -> jsonrpc package
      rpcclient package -> client package
      rpcserver package -> server package
      JSONRPCClient to Client
      JSONRPCRequestBatch to RequestBatch
      JSONRPCCaller to Caller
      StartHTTPServer to Serve
      StartHTTPAndTLSServer to ServeTLS
      NewURIClient to NewURI
      NewJSONRPCClient to New
      NewJSONRPCClientWithHTTPClient to NewWithHTTPClient
      NewWSClient to NewWS
      Unexpose ResponseWriterWrapper
      Remove unused http_params.go
FEATURES:
IMPROVEMENTS:
  • [abci/server] #​4719 Print panic & stack trace to STDERR if logger is not set (@​melekes)
  • [types] #​4638 Implement Header#ValidateBasic (@​alexanderbez)
  • [buildsystem] #​4378 Replace build_c and install_c with TENDERMINT_BUILD_OPTIONS parsing. The following options are available:
    • nostrip: don't strip debugging symbols nor DWARF tables.
    • cleveldb: use cleveldb as db backend instead of goleveldb.
    • race: pass -race to go build and enable data race detection.
  • [mempool] #​4759 Allow ReapX and CheckTx functions to run in parallel (@​melekes)
  • [rpc/core] #​4844 Do not lock consensus state in /validators, /consensus_params and /status (@​melekes)
BUG FIXES:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@p2p-renovate

p2p-renovate Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: downloading github.com/snikch/goodman v0.0.0-20171125024755-10e37e294daa
go: downloading github.com/p2p-org/cosmos-sdk-rootchain v0.0.0-20200601091207-a4638983ad97
go: github.com/cosmos/gaia/lcd_test imports
	github.com/tendermint/tendermint/rpc/lib/server: cannot find module providing package github.com/tendermint/tendermint/rpc/lib/server
go: github.com/cosmos/gaia/lcd_test imports
	github.com/cosmos/cosmos-sdk/tests imports
	github.com/tendermint/tendermint/rpc/lib/client: cannot find module providing package github.com/tendermint/tendermint/rpc/lib/client

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants