# Agoric-upgrade-14 security bulletin

**URL:** <https://community.agoric.com/t/agoric-upgrade-14-security-bulletin/649>\
**Category:** Security\
**Created:** [April 9, 2024, 3:48pm UTC](https://community.agoric.com/t/agoric-upgrade-14-security-bulletin/649 "2024-04-09T15:48:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sraph\_agoric](https://avatars.discourse-cdn.com/v4/letter/s/4bbf92/32.png) [@sraph\_agoric](https://community.agoric.com/u/sraph_agoric)\
**Post date:** [April 9, 2024, 3:48pm UTC](https://community.agoric.com/t/agoric-upgrade-14-security-bulletin/649/1 "2024-04-09T15:48:31Z")

</div>

# 🛡Upgrade-14 Security Bulletin

This bulletin highlights security improvements in the recent Agoric upgrade, agoric-upgrade-14.

To summarize, a large component of upgrade-14 is the incremental major upgrade of the interchain stack. Many of these upgrades address vulnerabilities found in earlier versions.

## CometBFT

Upgraded from 0.34.27 to 0.34.30, which included the following security fixes (from oldest to newest):

✅ [#557: Fix(merkle): broken error handling in ValueOp (VSA-2022-100)](https://github.com/cometbft/cometbft/issues/557)

- This is a proactive fix to an issue where merkle proof error handling could allow an attacker to forge membership proofs for arbitrary key-value pairs.
- Instead of allowing verification of Merkle Proofs against empty trees, the module now errors as expected.
- Fixed in [v0.34.28](https://github.com/cometbft/cometbft/blob/v0.34.30/CHANGELOG.md#v03428).

✅ [#788: Struct Client exposes sensitive data (backport #784)](https://github.com/cometbft/cometbft/pull/788)

- This is a low severity issue where RPC client credentials were accidentally logged.
- Fixed in [v0.34.29](https://github.com/cometbft/cometbft/blob/v0.34.30/CHANGELOG.md#v03429).

✅ [#794: Unsafe int cast in kill command (backport #783)](https://github.com/cometbft/cometbft/pull/794)

- This is a low severity issue where an unsafe integer cast could result in the kill command killing the wrong process.
- Fixed in [v0.34.29](https://github.com/cometbft/cometbft/blob/v0.34.30/CHANGELOG.md#v03429).

✅ [#863: Recursive call after rename to (\*PeerState).MarshalJSON](https://github.com/cometbft/cometbft/issues/863)

- This is a low severity issue where a node configured to debug log level will halt due to a double lock when attempting to log peer state.
- Fixed in [v0.34.29](https://github.com/cometbft/cometbft/blob/v0.34.30/CHANGELOG.md#v03429).

✅ [#890: Prevent a transaction to appear twice in the mempool](https://github.com/cometbft/cometbft/pull/890)

- This is a low severity issue where transactions could appear twice in the mempool when the cache overflows.
- Fixed in [v0.34.29](https://github.com/cometbft/cometbft/blob/v0.34.30/CHANGELOG.md#v03429).

## Cosmos-SDK

Upgraded from 0.45.16 to 0.46.16. There are no notable new security fixes as we applied patches (such as [dragonberry](https://forum.cosmos.network/t/ibc-security-advisory-dragonberry/7702) and [barberry](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825)) for all known security issues.

## Ibc-go

Upgraded from 4.5.1 to 6.2.1. No notable security fixes.

* * *

For a full list of changes that include non-security fixes, see the agoric-upgrade-14 [release notes](https://github.com/Agoric/agoric-sdk/releases/tag/agoric-upgrade-14).

If you need to get in touch with the Agoric security team, do not hesitate to email us at [security@agoric.com](mailto:security@agoric.com). Friendly reminder that we have a [bug bounty](https://github.com/Agoric/agoric-sdk/blob/agoric-upgrade-13/SECURITY.md) and reward vulnerabilities reported to us via HackerOne.