Merge pull request from GHSA-j496-crgh-34mx

go.mod

@@ -3,6 +3,7 @@ go 1.19
 module github.com/cosmos/ibc-go/v4
 
 retract (
+	[v4.4.1, v4.5.1] // contains ASA-2024-007 vulnerability
 	v4.4.0 // contains huckleberry vulnerability
 	v4.3.0 // contains huckleberry vulnerability
 	v4.2.1 // contains state machine breaking change
@@ -150,4 +151,4 @@ require (
 replace (
 	github.com/gogo/protobuf => github.com/regen-network/protobuf v1.3.3-alpha.regen.1
 	github.com/tendermint/tendermint => github.com/cometbft/cometbft v0.34.27
-)
+)

modules/core/keeper/msg_server.go

@@ -483,17 +483,17 @@ func (k Keeper) Timeout(goCtx context.Context, msg *channeltypes.MsgTimeout) (*c
 		return nil, sdkerrors.Wrap(err, "timeout packet verification failed")
 	}
 
+	// Delete packet commitment
+	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
+		return nil, err
+	}
+
 	// Perform application logic callback
 	err = cbs.OnTimeoutPacket(ctx, msg.Packet, relayer)
 	if err != nil {
 		return nil, sdkerrors.Wrap(err, "timeout packet callback failed")
 	}
 
-	// Delete packet commitment
-	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
-		return nil, err
-	}
-
 	defer func() {
 		telemetry.IncrCounterWithLabels(
 			[]string{"ibc", "timeout", "packet"},
@@ -551,6 +551,11 @@ func (k Keeper) TimeoutOnClose(goCtx context.Context, msg *channeltypes.MsgTimeo
 		return nil, sdkerrors.Wrap(err, "timeout on close packet verification failed")
 	}
 
+	// Delete packet commitment
+	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
+		return nil, err
+	}
+
 	// Perform application logic callback
 	//
 	// NOTE: MsgTimeout and MsgTimeoutOnClose use the same "OnTimeoutPacket"
@@ -560,11 +565,6 @@ func (k Keeper) TimeoutOnClose(goCtx context.Context, msg *channeltypes.MsgTimeo
 		return nil, sdkerrors.Wrap(err, "timeout packet callback failed")
 	}
 
-	// Delete packet commitment
-	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
-		return nil, err
-	}
-
 	defer func() {
 		telemetry.IncrCounterWithLabels(
 			[]string{"ibc", "timeout", "packet"},