PT-2024-40031 · Unknown+1 · Cosmwasm-Vm+1

Published 2024-12-10 · Updated 2024-12-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions wasmvm versions 2.1.0 through 2.1.2 wasmvm versions 2.0.0 through 2.0.3 wasmvm versions prior to 1.5.5 cosmwasm-vm versions 2.1.0 through 2.1.3 cosmwasm-vm versions 2.0.0 through 2.0.6 cosmwasm-vm versions prior to 1.5.8

Description The issue was found by meadow101 and reported to the Cosmos Bug Bounty Program on HackerOne. A patch has been developed and released. The patch is consensus breaking and requires a coordinated upgrade.

Recommendations For wasmvm versions 2.1.0 through 2.1.2, update to version 2.1.3. For wasmvm versions 2.0.0 through 2.0.3, update to version 2.0.4. For wasmvm versions prior to 1.5.5, update to version 1.5.5. For cosmwasm-vm versions 2.1.0 through 2.1.3, update to version 2.1.4. For cosmwasm-vm versions 2.0.0 through 2.0.6, update to version 2.0.7. For cosmwasm-vm versions prior to 1.5.8, update to version 1.5.8. To apply the patch, check the current wasmvm version, bump the dependency in your go.mod, update static libraries if used, and follow regular practices to deploy chain upgrades.

Related Identifiers

GHSA-2Q97-M5RC-P3GP

Affected Products

Cosmwasm-Vm

Wasmvm

References · 7

• https://osv.dev/vulnerability/GHSA-2q97-m5rc-p3gp · Vendor Advisory
• https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea · Note
• https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9 · Note
• https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492 · Note
• https://github.com/CosmWasm/wasmvm · Note
• https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-2q97-m5rc-p3gp · Note
• https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-007.md · Note