PT-2024-40482 · Unknown+1 · Cosmwasm-Vm+1

Published 2024-12-10 · Updated 2024-12-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions wasmvm versions 2.1.0 through 2.1.2 wasmvm versions 2.0.0 through 2.0.3 wasmvm versions prior to 1.5.5 cosmwasm-vm versions 2.1.0 through 2.1.3 cosmwasm-vm versions 2.0.0 through 2.0.6 cosmwasm-vm versions prior to 1.5.8

Description The issue was found by meadow101 and reported to the Cosmos Bug Bounty Program on HackerOne. A patch has been developed and released. The patch is consensus breaking and requires a coordinated upgrade.

Recommendations For wasmvm versions 2.1.0 through 2.1.2, update to version 2.1.3. For wasmvm versions 2.0.0 through 2.0.3, update to version 2.0.4. For wasmvm versions prior to 1.5.5, update to version 1.5.5. For cosmwasm-vm versions 2.1.0 through 2.1.3, update to version 2.1.4. For cosmwasm-vm versions 2.0.0 through 2.0.6, update to version 2.0.7. For cosmwasm-vm versions prior to 1.5.8, update to version 1.5.8.

Related Identifiers

GHSA-VMQH-5232-V43R

Affected Products

Cosmwasm-Vm

Wasmvm

References · 7

• https://osv.dev/vulnerability/GHSA-vmqh-5232-v43r · Vendor Advisory
• https://github.com/CosmWasm/cosmwasm/commit/108e7dcbf9c21df0fa83f355ad3a7355d7f220cb · Note
• https://github.com/CosmWasm/cosmwasm/commit/edcdbc520d4f5521eed42de6e2869658278e91fd · Note
• https://github.com/CosmWasm/cosmwasm/commit/f63429ca59eb44dd5d780c1572016581337091e4 · Note
• https://github.com/CosmWasm/wasmvm · Note
• https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-vmqh-5232-v43r · Note
• https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-008.md · Note