id: GO-2023-1881
modules:
    - module: github.com/cosmos/cosmos-sdk
      vulnerable_at: 0.47.3
      packages:
        - package: github.com/cosmos/cosmos-sdk/x/crisis
summary: The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk
description: |-
    If a transaction is sent to the x/crisis module to check an invariant, the
    ConstantFee parameter of the chain is not charged.

    No patch will be released, as the package is planned to be deprecated and
    replaced.
ghsas:
    - GHSA-w5w5-2882-47pc
references:
    - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-w5w5-2882-47pc
    - report: https://github.com/cosmos/cosmos-sdk/issues/15706