From 9b4fa9003b98c8eb0a6f46dab53c988fad63eeaa Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 11 Jun 2025 14:45:39 +0000 Subject: [PATCH] Publish Advisories GHSA-79xg-q4qm-7v9w GHSA-hq9p-pm7w-8p54 --- .../GHSA-79xg-q4qm-7v9w.json | 112 ++++++++++++++++++ .../GHSA-hq9p-pm7w-8p54.json | 73 ++++++++++++ 2 files changed, 185 insertions(+) create mode 100644 advisories/github-reviewed/2025/06/GHSA-79xg-q4qm-7v9w/GHSA-79xg-q4qm-7v9w.json create mode 100644 advisories/github-reviewed/2025/06/GHSA-hq9p-pm7w-8p54/GHSA-hq9p-pm7w-8p54.json diff --git a/advisories/github-reviewed/2025/06/GHSA-79xg-q4qm-7v9w/GHSA-79xg-q4qm-7v9w.json b/advisories/github-reviewed/2025/06/GHSA-79xg-q4qm-7v9w/GHSA-79xg-q4qm-7v9w.json new file mode 100644 index 00000000000..332b8a07cf7 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-79xg-q4qm-7v9w/GHSA-79xg-q4qm-7v9w.json @@ -0,0 +1,112 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79xg-q4qm-7v9w", + "modified": "2025-06-11T14:44:39Z", + "published": "2025-06-11T14:44:38Z", + "aliases": [], + "summary": "CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error", + "details": "# CWA-2025-006: Improper error handling may lead to IBC channel opening despite error\n\n**Severity**\n\nHigh (Considerable + Likely)[^1]\n\n**Affected versions:**\n\n- wasmd 0.60.0\n- wasmd >= 0.51.0 < 0.55.1\n\n**Patched versions:**\n\n- wasmd 0.60.1, 0.55.1, 0.54.1, 0.53.3\n\n## Description of the bug\n\nA contract erroring during IBC channel opening does not prevent the channel from opening.\n\n## Applying the patch\n\nThe patch will be shipped in a wasmd release. You will also have to update `libwasmvm` if you build statically.\nIf you already use the latest / close to latest wasmd, you can update more or less as follows:\n\n1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd`\n2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.60.1 (Cosmos SDK 0.53 compatible), 0.55.1 (Cosmos SDK 0.50 compatible), 0.54.1 or 0.53.3; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.\n4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.60.1, 0.55.1, 0.54.1 or 0.53.3.\n5. Follow your regular practices to deploy chain upgrades.\n\nThe patch is consensus breaking.\n\n## Acknowledgement\n\nThis problem was discovered during an audit of the CosmWasm stack performed by Sherlock and funded by ICF/ICL in Q1 2025. Thank you for that work!\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see .\n\n## Timeline\n\n- 2025-03-03: Auditor informs Confio about this issue.\n- 2025-04-10: Confio developed the patch internally.\n- 2025-06-05: Upcoming patch is announced.\n- 2025-06-10: Patch is released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1.2: ", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.60.0" + }, + { + "fixed": "0.60.1" + } + ] + } + ], + "versions": [ + "0.60.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.55.0" + }, + { + "fixed": "0.55.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.54.0" + }, + { + "fixed": "0.54.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.51.0" + }, + { + "fixed": "0.53.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/CosmWasm/wasmd/security/advisories/GHSA-79xg-q4qm-7v9w" + }, + { + "type": "WEB", + "url": "https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2025-006.md" + }, + { + "type": "PACKAGE", + "url": "https://github.com/CosmWasm/wasmd" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-06-11T14:44:38Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/06/GHSA-hq9p-pm7w-8p54/GHSA-hq9p-pm7w-8p54.json b/advisories/github-reviewed/2025/06/GHSA-hq9p-pm7w-8p54/GHSA-hq9p-pm7w-8p54.json new file mode 100644 index 00000000000..12411925998 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-hq9p-pm7w-8p54/GHSA-hq9p-pm7w-8p54.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hq9p-pm7w-8p54", + "modified": "2025-06-11T14:44:04Z", + "published": "2025-06-11T14:44:04Z", + "aliases": [ + "CVE-2025-49146" + ], + "summary": "pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration", + "details": "### Impact\nWhen the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.\n\n### Patches\nTBD\n\n### Workarounds\n\nConfigure `sslMode=verify-full` to prevent MITM attacks.\n\n### References\n\n* https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256\n* https://datatracker.ietf.org/doc/html/rfc7677\n* https://datatracker.ietf.org/doc/html/rfc5802", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.postgresql:postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.7.4" + }, + { + "fixed": "42.7.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54" + }, + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0" + }, + { + "type": "WEB", + "url": "https://datatracker.ietf.org/doc/html/rfc5802" + }, + { + "type": "WEB", + "url": "https://datatracker.ietf.org/doc/html/rfc7677" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgjdbc/pgjdbc" + }, + { + "type": "WEB", + "url": "https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-06-11T14:44:04Z", + "nvd_published_at": null + } +} \ No newline at end of file