# Agoric-upgrade-13 security bulletin

**URL:** <https://community.agoric.com/t/agoric-upgrade-13-security-bulletin/581>\
**Category:** Security\
**Created:** [December 28, 2023, 9:12pm UTC](https://community.agoric.com/t/agoric-upgrade-13-security-bulletin/581 "2023-12-28T21:12:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sraph\_agoric](https://avatars.discourse-cdn.com/v4/letter/s/4bbf92/32.png) [@sraph\_agoric](https://community.agoric.com/u/sraph_agoric)\
**Post date:** [December 28, 2023, 9:12pm UTC](https://community.agoric.com/t/agoric-upgrade-13-security-bulletin/581/1 "2023-12-28T21:12:46Z")

</div>

# 🛡Upgrade-13 Security Bulletin

This bulletin highlights security improvements in the recent Agoric upgrade, agoric-upgrade-13.

## Cosmos-SDK Advisory GHSA-qfc5-6r3j-jj22

✅ [#8581: Backport x/crisis non halt](https://github.com/Agoric/agoric-sdk/issues/8581)

- The [advisory](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-qfc5-6r3j-jj22) pertains to the x/crisis module not causing chain halt in the event of an invariant violation.
- Our mitigation is to remove the module in anticipation of deprecation in future releases. By removing we also remove the need to address a later [advisory](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-w5w5-2882-47pc) involving the x/crisis module failing to charge ConstantFee.

For a full list of changes that include non-security fixes, see the agoric-upgrade-13 [release notes](https://github.com/Agoric/agoric-sdk/releases/tag/agoric-upgrade-13).

If you need to get in touch with the Agoric security team, do not hesitate to email us at [security@agoric.com](mailto:security@agoric.com). Friendly reminder that we have a [bug bounty](https://github.com/Agoric/agoric-sdk/blob/agoric-upgrade-13/SECURITY.md) and reward vulnerabilities reported to us via HackerOne.