Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release v0.41.2 #8615

Merged
merged 1 commit into from
Feb 18, 2021
Merged

Release v0.41.2 #8615

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,12 @@ Ref: https://keepachangelog.com/en/1.0.0/

# Changelog

## [v0.41.2](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.41.2) - 2021-02-18

### Improvements

* Bump tendermint dependency to v0.34.7.

## [v0.41.1](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.41.1) - 2021-02-17

### Bug Fixes
Expand Down
41 changes: 6 additions & 35 deletions RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,39 +1,10 @@
# Cosmos SDK v0.41.1 "Stargate" Release Notes
# Cosmos SDK v0.41.2 "Stargate" Release Notes

This release includes two security patches, and does not introduce any breaking changes. It is **highly recommended** that all applications using v0.41.0 upgrade to v0.41.1 as soon as possible.
This release upgrades Tendermint to v0.34.7, and does not introduce any breaking changes. It is **highly recommended** that all applications using v0.41.1 upgrade to v0.41.2 as soon as possible.

See the [Cosmos SDK v0.41.1 milestone](https://github.com/cosmos/cosmos-sdk/milestone/38?closed=1) on our issue tracker for details.
### Tendermint v0.34.7

### Security Patch #1: All gRPC requests are now routed through ABCI
Operators running nodes that manage their keys through the Tendermint's `FilePV` implementation were
susceptible to leaking private keys material in the logs. The issue is now fixed in Tendermint v0.34.5 and later versions.

When Tendermint commits a new block, the `versions` map in IAVL MutableTree is updated. If, at the same time, a concurrent gRPC request is performed, it will read the same `versions` map, causing the node to crash.

The patch consists of routing all gRPC requests through ABCI. The Go implementation of ABCI uses global lock on all requests, making them linearizable (received one at a time) which in turn prevents concurrent map reads and writes.

We are exploring on ways of introducing concurrent gRPC queries in [#8591](https://github.com/cosmos/cosmos-sdk/issues/8591).

This bug has been reported via HackerOne.

### Security Patch #2: Remove `GetValidator` cache map

The `x/staking` keeper holds an internal `validatorCache` cache map of validators. When multipile gRPC queries are performed simulataneously, concurrent reads and writes of this map can happen, causing the node to crash.

The patch removes the `validatorCache` altogether. Benchmarks show that the removal of the cache map even increases performance.

Is is important to note that the Security Patch #1 should also fix this bug, as it forces synchronous gRPC queries and therefore synchronous map reads/writes. However, it was deemed useful to include this bugfix too in this release.

### Bug Fixes & Improvements

Several bug fixes and non-breaking improvements are included in this release.

Tendermint has been bumped to v0.34.4 to address a memory leak.

Environment variables are now correctly populated to CLI flags. When using the Tendermint subcommands `tendermint show-*` from the CLI, the SDK doesn't create new files anymore.

Keyring imports from older versions are fixed.

Additional validation for client denom metadata has been added.

On the IBC side, a `packet_connection` attribute has been added to IBC events to enable relayer filtering.

For the full change log, please see the [CHANGELOG](https://github.com/cosmos/cosmos-sdk/blob/v0.41.0/CHANGELOG.md).
For more information regarding the patch, please refer to [Tendermint's changelog](https://github.com/tendermint/tendermint/blob/v0.34.7/CHANGELOG.md#v0345).
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ require (
github.com/tendermint/btcd v0.1.1
github.com/tendermint/crypto v0.0.0-20191022145703-50d29ede1e15
github.com/tendermint/go-amino v0.16.0
github.com/tendermint/tendermint v0.34.4
github.com/tendermint/tendermint v0.34.7
github.com/tendermint/tm-db v0.6.4
golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad
google.golang.org/genproto v0.0.0-20210114201628-6edceaf6022f
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -557,8 +557,8 @@ github.com/tendermint/go-amino v0.16.0/go.mod h1:TQU0M1i/ImAo+tYpZi73AU3V/dKeCoM
github.com/tendermint/tendermint v0.34.0-rc4/go.mod h1:yotsojf2C1QBOw4dZrTcxbyxmPUrT4hNuOQWX9XUwB4=
github.com/tendermint/tendermint v0.34.0-rc6/go.mod h1:ugzyZO5foutZImv0Iyx/gOFCX6mjJTgbLHTwi17VDVg=
github.com/tendermint/tendermint v0.34.0/go.mod h1:Aj3PIipBFSNO21r+Lq3TtzQ+uKESxkbA3yo/INM4QwQ=
github.com/tendermint/tendermint v0.34.4 h1:E7qkvFGx27d8ugVLiAY2iWP6DL5cep3l/mpTaWKHyBA=
github.com/tendermint/tendermint v0.34.4/go.mod h1:JVuu3V1ZexOaZG8VJMRl8lnfrGw6hEB2TVnoUwKRbss=
github.com/tendermint/tendermint v0.34.7 h1:lvBJFNqpDuEzKfLZKtUXOL5dMOpqHonHlO6LCujyl6E=
github.com/tendermint/tendermint v0.34.7/go.mod h1:JVuu3V1ZexOaZG8VJMRl8lnfrGw6hEB2TVnoUwKRbss=
github.com/tendermint/tm-db v0.6.2/go.mod h1:GYtQ67SUvATOcoY8/+x6ylk8Qo02BQyLrAs+yAcLvGI=
github.com/tendermint/tm-db v0.6.3 h1:ZkhQcKnB8/2jr5EaZwGndN4owkPsGezW2fSisS9zGbg=
github.com/tendermint/tm-db v0.6.3/go.mod h1:lfA1dL9/Y/Y8wwyPp2NMLyn5P5Ptr/gvDFNWtrCWSf8=
Expand Down