diff --git a/advisories/github-reviewed/2024/08/GHSA-rg2q-2jh9-447q/GHSA-rg2q-2jh9-447q.json b/advisories/github-reviewed/2024/08/GHSA-rg2q-2jh9-447q/GHSA-rg2q-2jh9-447q.json index bad3ac5ebee..75de93c0bd5 100644 --- a/advisories/github-reviewed/2024/08/GHSA-rg2q-2jh9-447q/GHSA-rg2q-2jh9-447q.json +++ b/advisories/github-reviewed/2024/08/GHSA-rg2q-2jh9-447q/GHSA-rg2q-2jh9-447q.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-rg2q-2jh9-447q", - "modified": "2024-08-08T16:30:50Z", + "modified": "2024-08-08T17:03:07Z", "published": "2024-08-08T16:30:50Z", "aliases": [ ], "summary": "Gas mispricing in cosmwasm-vm", - "details": "**Component:** wasmvm\n**Criticality:** Medium ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Moderate; L:Likely)\n**Patched versions:** wasmvm 1.5.3, 2.0.2, 2.1.1\n\nSome Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the [gas target](https://github.com/CosmWasm/cosmwasm/blob/e50490c4199a234200a497219b27f071c3409f58/docs/GAS.md#cosmwasm-gas-pricing) we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.\n\nSee [CWA-2024-004](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md) for more details.\n", + "details": "**Component:** wasmvm\n**Criticality:** Medium ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Moderate; L:Likely)\n**Patched versions:** wasmvm 1.5.4, 2.0.3, 2.1.2\n\nSome Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the [gas target](https://github.com/CosmWasm/cosmwasm/blob/e50490c4199a234200a497219b27f071c3409f58/docs/GAS.md#cosmwasm-gas-pricing) we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.\n\nSee [CWA-2024-004](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md) for more details.\n", "severity": [ { "type": "CVSS_V3", @@ -19,63 +19,6 @@ } ], "affected": [ - { - "package": { - "ecosystem": "Go", - "name": "github.com/CosmWasm/wasmvm/v2" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.1.0" - }, - { - "fixed": "2.1.1" - } - ] - } - ] - }, - { - "package": { - "ecosystem": "Go", - "name": "github.com/CosmWasm/wasmvm/v2" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.2" - } - ] - } - ] - }, - { - "package": { - "ecosystem": "Go", - "name": "github.com/CosmWasm/wasmvm" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.5.3" - } - ] - } - ] - }, { "package": { "ecosystem": "crates.io", @@ -132,6 +75,63 @@ ] } ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmvm/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmvm/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/CosmWasm/wasmvm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.4" + } + ] + } + ] } ], "references": [