| id: GO-2023-1881 |
| modules: |
| - module: github.com/cosmos/cosmos-sdk |
| vulnerable_at: 0.47.3 |
| packages: |
| - package: github.com/cosmos/cosmos-sdk/x/crisis |
| summary: The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk |
| description: |- |
| If a transaction is sent to the `x/crisis` module to check an invariant, the |
| ConstantFee parameter of the chain is not charged. |
| |
| No patch will be released, as the package is planned to be deprecated and |
| replaced. |
| ghsas: |
| - GHSA-w5w5-2882-47pc |
| references: |
| - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-w5w5-2882-47pc |
| - report: https://github.com/cosmos/cosmos-sdk/issues/15706 |
