Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update CWA-2024-009 #57

Merged
merged 2 commits into from
Dec 10, 2024
+6 −5
Merged

Update CWA-2024-009 #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5211a9b
Add GHSA for CWA-2024-009
webmaster128 Dec 10, 2024
aa51acf
Bump patch release to 0.53.2 for 009
webmaster128 Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions CWAs/CWA-2024-009.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Low (Marginal + Likely)[^1]

**Patched versions:**

- wasmd 0.53.1
- wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used)

## Description of the bug

Expand All @@ -29,9 +29,9 @@ The patch will be shipped in a wasmd release. You will also have to update `libw
If you already use the latest / close to latest wasmd, you can update more or less as follows:

1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd`
2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.53.1 (Cosmos SDK 0.50 compatible); `go mod tidy`; commit.
2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.53.2 (Cosmos SDK 0.50 compatible); `go mod tidy`; commit.
3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.53.1.
4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.53.2.
5. Follow your regular practices to deploy chain upgrades.

To double check if the correct library version is loaded at runtime, use this query:
Expand All @@ -42,7 +42,7 @@ If you are instead using wasmvm 2.1.2, then upgrading to 2.1.4 includes the cons

### DIY Patch

If you are unable to upgrade to the latest version, you can backport the wasmd patch to your version. The patch is available at [Wasmd 0.53.1](https://github.com/CosmWasm/wasmd/compare/v0.53.0...v0.53.1).
If you are unable to upgrade to the latest version, you can backport the wasmd patch to your version. The patch is available at [Wasmd 0.53.2](https://github.com/CosmWasm/wasmd/compare/v0.53.0...v0.53.2).
However, if you are on an older version of wasmd, you will also be using a different version of wasmvm. We provide the required patches for wasmvm in versions 2.1.4, 2.0.5, 1.5.6.
To upgrade using this method:

Expand Down
3 changes: 2 additions & 1 deletion CWAs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

| Severity[^1] | Scope[^2] | ID | Aliases |
| ------------ | --------- | ---------------------------------------------------------------------------- | ------------------------------------------ |
| Low | VM | [CWA-2024-009][CWA-2024-009] |
| Low | VM | [CWA-2024-009][CWA-2024-009] | [GHSA-vmg2-r3xv-r3xf] |
| Medium | VM | [CWA-2024-008: Panic in wasmvm can slow down block production][CWA-2024-008] | [GHSA-vmqh-5232-v43r] |
| Medium | VM | [CWA-2024-007: Incorrect metering][CWA-2024-007] | [GHSA-2q97-m5rc-p3gp] |
| Medium | x/wasm | [CWA-2024-006: Non-deterministic module_query_safe query][CWA-2024-006] | [GHSA-fpgj-cr28-fvpx] |
Expand Down Expand Up @@ -34,6 +34,7 @@
[GHSA-fpgj-cr28-fvpx]: https://github.com/advisories/GHSA-fpgj-cr28-fvpx
[GHSA-2q97-m5rc-p3gp]: https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-2q97-m5rc-p3gp
[GHSA-vmqh-5232-v43r]: https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-vmqh-5232-v43r
[GHSA-vmg2-r3xv-r3xf]: https://github.com/CosmWasm/wasmd/security/advisories/GHSA-vmg2-r3xv-r3xf

## 2023

Expand Down
Loading