CVE:CVE-2022-23507
CNNVD:CNNVD-202212-3331
Tendermint是美国Tendermint公司的一款Byzantine Fault Tolerant (BFT) 式中间件。
Tendermint 0.28.0之前版本存在数据伪造问题漏洞，该漏洞源于包含通过不正确的加密签名验证进行的潜在攻击，影响任何使用 tendermint-light-client 和相关软件包执行轻客户端验证的人，攻击者利用该漏洞可以欺骗轻客户端。
solution:Upgrade tendermint-light-client-js_project tendermint-light-client-js to a higher version than 0.28.0,and avoid the version (,0.28.0); Upgrade tendermint-light-client-verifier_project tendermint-light-client-verifier to a higher version than 0.28.0,and avoid the version (,0.28.0); Upgrade tendermint-light-client_project tendermint-light-client to a higher version than 0.28.0,and avoid the version (,0.28.0)