x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-vmqh-5232-v43r

[GoVulnBot]

Advisory GHSA-vmqh-5232-v43r references a vulnerability in the following Go modules:

Module
github.com/CosmWasm/wasmvm
github.com/CosmWasm/wasmvm/v2

Description:

CWA-2024-008

Severity

Medium (Moderate + Likely)[^1]

Affected versions:

• wasmvm >= 2.1.0, < 2.1.3
• wasmvm >= 2.0.0, < 2.0.4
• wasmvm < 1.5.5
• cosmwasm-vm >= 2.1.0, < 2.1.4
• cosmwasm-vm >= 2.0.0, < 2.0.7
• cosmwasm-vm < 1.5.8

Patched versions:

• wasmvm 1.5.5, 2.0.4, 2.1.3
• cosmwasm-vm 1.5.8, 2.0.7, 2.1.4

Description of the bug

(Blank for now. We'll add more detail once chains had a chance to upgrade.)

Patch

• 1.5: CosmWasm/cosmwasm@edcdbc5
• 2.0: CosmWasm/cosmwasm@f63429ca59eb...

References:

• ADVISORY: GHSA-vmqh-5232-v43r
• ADVISORY: GHSA-vmqh-5232-v43r
• FIX: CosmWasm/cosmwasm@108e7dc
• FIX: CosmWasm/cosmwasm@edcdbc5
• FIX: CosmWasm/cosmwasm@f63429c
• WEB: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-008.md

Cross references:

• github.com/CosmWasm/wasmvm appears in 1 other report(s):
  • data/excluded/GO-2024-3060.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-rg2q-2jh9-447q #3060) NOT_GO_CODE

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/CosmWasm/wasmvm
      versions:
        - fixed: 1.5.5
      vulnerable_at: 1.5.4
    - module: github.com/CosmWasm/wasmvm/v2
      versions:
        - introduced: 2.0.0
        - fixed: 2.0.4
        - introduced: 2.1.0
        - fixed: 2.1.3
      vulnerable_at: 2.1.2
summary: Panic in wasmvm can slow down block production in github.com/CosmWasm/wasmvm
ghsas:
    - GHSA-vmqh-5232-v43r
references:
    - advisory: https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-vmqh-5232-v43r
    - advisory: https://github.com/advisories/GHSA-vmqh-5232-v43r
    - fix: https://github.com/CosmWasm/cosmwasm/commit/108e7dcbf9c21df0fa83f355ad3a7355d7f220cb
    - fix: https://github.com/CosmWasm/cosmwasm/commit/edcdbc520d4f5521eed42de6e2869658278e91fd
    - fix: https://github.com/CosmWasm/cosmwasm/commit/f63429ca59eb44dd5d780c1572016581337091e4
    - web: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-008.md
source:
    id: GHSA-vmqh-5232-v43r
    created: 2024-12-10T17:01:25.71974083Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/634995 mentions this issue: data/excluded: add 2 reports