# Tendermint Core Security Advisory Syringa

**URL:** <https://forum.cosmos.network/t/tendermint-core-security-advisory-syringa/3741>\
**Category:** Security\
**Created:** [July 1, 2020, 2:01pm UTC](https://forum.cosmos.network/t/tendermint-core-security-advisory-syringa/3741 "2020-07-01T14:01:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tessr](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/tessr/32/1262_2.png) [@tessr](https://forum.cosmos.network/u/tessr)\
**Post date:** [July 1, 2020, 2:01pm UTC](https://forum.cosmos.network/t/tendermint-core-security-advisory-syringa/3741/1 "2020-07-01T14:01:35Z")

</div>

Recently, a pair of security vulnerabilities was discovered in Tendermint Core 0.33. One of the vulnerabilities is a high-security issue. A patch for these issues, which requires no breaking changes, will be released in version 0.33.6 of Tendermint Core and in version 0.38.5 of the Cosmos SDK at 14:00 UTC on Thursday, July 2. Gaia is unaffected by this vulnerability.

If you are running software which depends on Tendermint Core 0.33 or Cosmos SDK 0.38, we encourage you to upgrade your software to the latest, most secure version as quickly as possible once this update becomes available.

_This notice has been posted in accordance with our [vulnerability disclosure policy](https://github.com/tendermint/tendermint/blob/master/SECURITY.md#disclosure-process). For future security alerts for Tendermint Core, you can also subscribe to our dedicated [security mailing list](http://eepurl.com/gZ5hQD)._

---

<div class="post-metadata">

**Author:** ![tessr](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/tessr/32/1262_2.png) [@tessr](https://forum.cosmos.network/u/tessr)\
**Post date:** [July 2, 2020, 3:05pm UTC](https://forum.cosmos.network/t/tendermint-core-security-advisory-syringa/3741/2 "2020-07-02T15:05:05Z")

</div>

The patches that resolve the issues comprising Advisory Syringa have been released in version 0.33.6 of Tendermint and in version 0.38.5 of the Cosmos SDK. All releases are now available to the public. A full timeline of the vulnerability disclosure and coordination activities that comprise this release should be available by Friday, July 10, 2020.

Tendermint 0.33.6 is available at [https://github.com/tendermint/tendermint/releases/tag/v0.33.6](https://github.com/tendermint/tendermint/releases/tag/v0.33.6) and Cosmos SDK 0.38.5 is available at [https://github.com/cosmos/cosmos-sdk/releases/tag/v0.38.5](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.38.5).

Tendermint 0.33.6 renames the VerifyCommitTrusting function to VerifyCommitLightTrusting. If you were relying on the light client, you may need to update your code. For more information, please see the [changelog](https://github.com/tendermint/tendermint/blob/master/CHANGELOG.md#v0336).

Additionally, a Common Vulnerabilities and Exposures (CVE) ID has been assigned: CVE-2020-15091. The list of CVEs is available at [https://cve.mitre.org/cve/](https://cve.mitre.org/cve/).

If you are running software which depends on Tendermint Core 0.33 or Cosmos SDK 0.38, we encourage you to upgrade your software to the latest, most secure version as quickly as possible.

_This notice has been posted in accordance with our [vulnerability disclosure policy](https://github.com/tendermint/tendermint/blob/master/SECURITY.md#disclosure-process). For future security alerts for Tendermint Core, you can also subscribe to our dedicated [security mailing list](http://eepurl.com/gZ5hQD)._