Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fill CWA-2024-005 and CWA-2024-006 #43

Merged
merged 1 commit into from
Aug 21, 2024
Merged

Fill CWA-2024-005 and CWA-2024-006 #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions CWAs/CWA-2024-005.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,34 @@ High (Critical + Likely)
- wasmd < 0.46.0

**Patched versions:** wasmd 0.53.0, 0.46.0

## Description of the bug

(Blank for now. We'll add more detail once chains had a chance to upgrade.)

## Applying the patch

The patch will be shipped in a wasmd release. You can update more or less as follows:

1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd`
2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.53.0 (Cosmos SDK 0.50 compatible) or 0.46.0 (Cosmos SDK 0.47 compatible) depending on which version you are on right now; `go mod tidy`; commit.
3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.53.0 or 0.46.0.
5. Follow your regular practices to deploy chain upgrades.

## Acknowledgement

This issue was found by [unknown feature](https://github.com/unknownfeature) who reported it to the Cosmos Bug Bounty Program on
HackerOne.

If you believe you have found a bug in the Interchain Stack or would like to contribute to the
program by reporting a bug, please see <https://hackerone.com/cosmos>.

## Timeline

- 2024-06-28: IBC Team receives a report through the Cosmos bug bounty program maintained by Amulet.
- 2024-07-18: Confio receives information about the report from the IBC Team.
- 2024-08-02: Confio developed the patch internally.
- 2024-08-19: Patch release announced though notifications list.
- 2024-08-20: Patch release announced on X: <https://x.com/CosmWasm/status/1825814580217381334>.
- 2024-08-21: Patch released.
30 changes: 30 additions & 0 deletions CWAs/CWA-2024-006.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,33 @@ Medium (Moderate + Likely)
- wasmd 0.52.0

**Patched versions:** wasmd 0.53.0

## Description of the bug

(Blank for now. We'll add more detail once chains had a chance to upgrade.)

## Applying the patch

The patch will be shipped in a wasmd release. You can update more or less as follows:

1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd`
2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.53.0; `go mod tidy`; commit.
3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.53.0.
5. Follow your regular practices to deploy chain upgrades.

## Acknowledgement

This issue was found by [amimart](https://github.com/amimart) who reported it to the
Cosmos Bug Bounty Program on HackerOne.

If you believe you have found a bug in the Interchain Stack or would like to contribute to the
program by reporting a bug, please see <https://hackerone.com/cosmos>.

## Timeline

- 2024-07-25: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.
- 2024-08-13: Confio developed the patch internally.
- 2024-08-19: Patch release announced though notifications list.
- 2024-08-20: Patch release announced on X: <https://x.com/CosmWasm/status/1825814580217381334>.
- 2024-08-21: Patch released.