mirrors/tendermint
1
0
Fork 0
mirror of https://github.com/tendermint/tendermint.git synced 2026-03-27 12:05:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

changelog: update 0.34.3 changelog with details on security vuln (bp #6108) (#6110)

Browse Source 
* changelog: update 0.34.3 changelog with details on security vuln (#6108)

Closes #6095.

(cherry picked from commit df0b868415)

# Conflicts:
#	CHANGELOG.md

* solve conflicts

Co-authored-by: Tess Rinearson <tess.rinearson@gmail.com>
Co-authored-by: Marko Baricevic <marbar3778@yahoo.com>
This commit is contained in:
mergify[bot]
2021-02-15 14:51:54 +01:00
committed by GitHub
parent 1b2174a0da
commit 1030072dd0
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
CHANGELOG.md
View File

@@ -23,18 +23,19 @@ Friendly reminder: We have a [bug bounty program](https://hackerone.com/tendermi
*January 19, 2021*
This release includes a fix for a high-severity security vulnerability.
More information on this vulnerability will be released on January 26, 2021
and this changelog will be updated.
This release includes a fix for a high-severity security vulnerability,
a DoS-vector that impacted Tendermint Core v0.34.0-v0.34.2. For more details, see
[Security Advisory Mulberry](https://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg)
or https://nvd.nist.gov/vuln/detail/CVE-2021-21271.
It also updates GoGo Protobuf to 1.3.2 in order to pick up the fix for
https://nvd.nist.gov/vuln/detail/CVE-2021-3121.
Tendermint Core v0.34.3 also updates GoGo Protobuf to 1.3.2 in order to pick up the fix for
https://nvd.nist.gov/vuln/detail/CVE-2021-3121.
Friendly reminder: We have a [bug bounty program](https://hackerone.com/tendermint).
### BUG FIXES
- [evidence] [N/A] Use correct source of evidence time (@cmwaters)
- [evidence] [[security fix]](https://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg) Use correct source of evidence time (@cmwaters)
- [proto] [\#5886](https://github.com/tendermint/tendermint/pull/5889) Bump gogoproto to 1.3.2 (@marbar3778)
## v0.34.2