id: GO-2023-1821
modules:
    - module: github.com/cosmos/cosmos-sdk
      vulnerable_at: 0.47.3
      packages:
        - package: github.com/cosmos/cosmos-sdk/x/crisis
summary: The x/crisis package does not cause chain halt in github.com/cosmos/cosmos-sdk
description: |-
    If an invariant check fails on a Cosmos SDK network, and a transaction is sent
    to the x/crisis package to halt the chain, the chain does not halt as originally
    intended.

    No patch will be released, as the package is planned to be deprecated and
    replaced.
ghsas:
    - GHSA-qfc5-6r3j-jj22
references:
    - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-qfc5-6r3j-jj22
    - report: https://github.com/cosmos/cosmos-sdk/issues/15325
    - report: https://github.com/cosmos/cosmos-sdk/issues/15706