# Agoric-upgrade-12 security bulletin

**URL:** <https://community.agoric.com/t/agoric-upgrade-12-security-bulletin/547>\
**Category:** Security\
**Created:** [November 21, 2023, 8:48pm UTC](https://community.agoric.com/t/agoric-upgrade-12-security-bulletin/547 "2023-11-21T20:48:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sraph\_agoric](https://avatars.discourse-cdn.com/v4/letter/s/4bbf92/32.png) [@sraph\_agoric](https://community.agoric.com/u/sraph_agoric)\
**Post date:** [November 21, 2023, 8:48pm UTC](https://community.agoric.com/t/agoric-upgrade-12-security-bulletin/547/1 "2023-11-21T20:48:10Z")

</div>

# 🛡Upgrade-12 Security Bulletin

This bulletin highlights security improvements in the recent Agoric upgrade, [agoric-upgrade-12](https://community.agoric.com/t/agoric-upgrade-12/538).

## CometBFT Advisory ASA-2023-002 aka p2p storms

✅ [#8483: Mitigate p2p storm CometBFT advisory](https://github.com/Agoric/agoric-sdk/issues/8483)

- This advisory pertains to a default CometBFT configuration that’s excessively permissive for common use cases, and may be abused to affect block times, thereby affecting chain availability through increased block times and nodes falling out of consensus, with the possibility of downstream effects leading to chain halt.
- Our initial mitigation is to tune consensus parameter (`BlockParams.MaxBytes`) to 5MB, a more reasonable size for our use cases.
- We are additionally exploring and testing more of the [mitigations](https://github.com/notional-labs/placid/blob/main/README.md#mitigations) recommended. It is a reminder that it’s important to explore tuning and implications of consensus parameters, especially as our chain evolves!

## Virtual storage module path validation

✅ [#8337: vstorage module path validation regular expression is incorrect](https://github.com/Agoric/agoric-sdk/issues/8337)

- This is an additional improvement to the security vulnerability we patched in our previous release, agoric-upgrade-11.
- See [previous notice](https://community.agoric.com/t/patched-security-vulnerability-on-the-agoric-network/493) for more details on related issues fixed in agoric-upgrade-11.

For a full list of changes that include non-security fixes, see the [agoric-upgrade-12 release notes](https://github.com/Agoric/agoric-sdk/releases/tag/agoric-upgrade-12).

If you need to get in touch with the Agoric security team, do not hesitate to email us at [security@agoric.com](mailto:security@agoric.com). Reminder that we have a [bug bounty](https://github.com/Agoric/agoric-sdk/blob/agoric-upgrade-12-rc0/SECURITY.md) and reward vulnerabilities reported to us via HackerOne.