[GHSA-22qq-3xwm-r5x4] github.com/cometbft/cometbft: backport to 0.37.15 not reflected

[zyl71]

Updates

• Affected products

Comments
Current record: Go:github.com/cometbft/cometbft: introduced=1.0.0-alpha.1 fixed=1.0.1 | introduced=0 fixed=0.38.17
Proposed: Go:github.com/cometbft/cometbft: introduced=1.0.0-alpha.1 fixed=1.0.1 | introduced=0 fixed=0.37.15 | introduced=0.38.0-alpha.1 fixed=0.38.17

v0.37.15 (Go proxy, 2025-02-03) carries the ASA-2025-001 fix as backport #4906 (f6935284), whose blocksync/pool.go hunk is identical to the referenced 2cebfde0; the published module zip contains the new check while v0.37.14's does not, and the v0.37.15 CHANGELOG names this GHSA. The record's single 0->0.38.17 range therefore marks v0.37.15 through v0.37.18 as vulnerable, and all four of those releases contain the fix.

Release lines: the 0.37 line is fixed at 0.37.15, so the current 0->0.38.17 range is split into 0->0.37.15 plus a separate 0.38 line. That line uses introduced=0.38.0-alpha.1 rather than 0.38.0 so that the five 2023 pre-releases (0.38.0-alpha.1, -alpha.2, -rc1..-rc3), which are unfixed and are covered by the current record, stay in scope; this matches the record's own 1.0.0-alpha.1 convention on the 1.0 line. The existing 1.0.0-alpha.1 -> 1.0.1 range is unchanged. 0.39.x and 0.40.0 were branched after the fix and contain it, so they stay outside every range.

Maintainer statements: the advisory says 'Affected versions: <= v0.38.16, v1.0.0' and 'The new CometBFT releases v1.0.1 and v0.38.17 fix this issue'; it does not mention the 0.37 line. The maintainers' own CHANGELOG at v0.37.15 (same day, 3 February 2025) states that the release fixes ASA-2025-001 and links to this GHSA, so this proposal agrees with the release notes; the advisory text is simply incomplete about 0.37.15.

Evidence:

• https://proxy.golang.org/github.com/cometbft/cometbft/@v/v0.37.15.info - v0.37.15 exists, Time 2025-02-03T05:53:43Z, tag commit b6b21319
• https://proxy.golang.org/github.com/cometbft/cometbft/@v/v0.37.14.info - previous release, 2024-12-20T14:05:37Z
• https://api.github.com/repos/cometbft/cometbft/commits?sha=v0.37.15&path=blocksync/pool.go&since=2024-12-01T00:00:00Z - one commit: f69352842a, 2025-02-03, 'merge commit from fork ([GHSA-qg25-hgjv-cg9q] Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy #4906)', referencing GHSA-22qq-3xwm-r5x4
• https://api.github.com/repos/cometbft/cometbft/commits/f69352842a56f3d3e2c3df27d7586f4da9d57c56 - the backported blocksync/pool.go hunk is identical to the one in 2cebfde06 (new 'base < peer.base || height < peer.height' check plus removePeer/banPeer)
• https://api.github.com/repos/cometbft/cometbft/compare/v0.37.15...2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5 - diverged: the referenced fix sha is not on the 0.37 branch, as expected for a backport
• https://raw.githubusercontent.com/cometbft/cometbft/v0.37.15/CHANGELOG.md - the v0.37.15 section fixes ASA-2025-001 with a link to this GHSA; the v0.37.14 CHANGELOG has no such entry
• https://proxy.golang.org/github.com/cometbft/cometbft/@v/v0.37.15.zip - blocksync/pool.go in the published module zip contains the new check; the same file in v0.37.14.zip does not
• https://raw.githubusercontent.com/cometbft/cometbft/v0.38.0-alpha.1/blocksync/pool.go - the 0.38.0 pre-releases have SetPeerRange without the check

Version checks:

• github.com/cometbft/cometbft 0.37.15 (registry 2025-02-03): contains fix: yes, via backport f69352842a56f3d3e2c3df27d7586f4da9d57c56; method: backport diff + artifact grep of the proxy.golang.org module zip + CHANGELOG; previous 0.37.14: no
• github.com/cometbft/cometbft 0.38.17 (registry 2025-02-03): contains fix: yes; method: compare API (v0.38.17...2cebfde06 = behind); previous 0.38.16: no (v0.38.16...2cebfde06 = ahead)
• github.com/cometbft/cometbft 1.0.1 (registry 2025-02-03): contains fix: yes; method: compare API (v1.0.1...0ee80cd60 = behind); previous 1.0.0: no (v1.0.0...0ee80cd60 = ahead)

This comes from a systematic comparison of advisory ranges with fix commits and published registry artifacts. Happy to adjust if the maintainers intend otherwise.