Skip to content

Commit 854d032

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: review 2 reports
 - data/reports/GO-2024-3101.yaml - data/reports/GO-2024-3339.yaml Fixes #3101 Fixes #3339 Change-Id: I76912805ed1c8c185041f8d157beaa99a48ee30c Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/637980 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent 1de53ca commit 854d032

File tree

4 files changed

+88
-14
lines changed

4 files changed

+88
-14
lines changed

‎data/osv/GO-2024-3101.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
"aliases": [
77
"GHSA-75qh-gg76-p2w4"
88
],
9-
"summary": "CWA-2023-004: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm",
10-
"details": "CWA-2023-004: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm",
9+
"summary": "Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm",
10+
"details": "A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.",
1111
"affected": [
1212
{
1313
"package": {
@@ -72,6 +72,6 @@
7272
],
7373
"database_specific": {
7474
"url": "https://pkg.go.dev/vuln/GO-2024-3101",
75-
"review_status": "UNREVIEWED"
75+
"review_status": "REVIEWED"
7676
}
7777
}

‎data/osv/GO-2024-3339.json

+51-4
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,40 @@
66
"aliases": [
77
"GHSA-8wcc-m6j2-qxvm"
88
],
9-
"summary": "ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk",
10-
"details": "ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk",
9+
"summary": "Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk",
10+
"details": "Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk",
1111
"affected": [
12+
{
13+
"package": {
14+
"name": "cosmossdk.io/x/tx",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.13.7"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {
31+
"imports": [
32+
{
33+
"path": "cosmossdk.io/x/tx/decode",
34+
"symbols": [
35+
"Decoder.Decode",
36+
"RejectUnknownFields",
37+
"RejectUnknownFieldsStrict"
38+
]
39+
}
40+
]
41+
}
42+
},
1243
{
1344
"package": {
1445
"name": "github.com/cosmos/cosmos-sdk",
@@ -33,7 +64,23 @@
3364
]
3465
}
3566
],
36-
"ecosystem_specific": {}
67+
"ecosystem_specific": {
68+
"imports": [
69+
{
70+
"path": "github.com/cosmos/cosmos-sdk/codec/types",
71+
"symbols": [
72+
"interfaceRegistry.UnpackAny"
73+
]
74+
},
75+
{
76+
"path": "github.com/cosmos/cosmos-sdk/codec/unknownproto",
77+
"symbols": [
78+
"RejectUnknownFields",
79+
"RejectUnknownFieldsStrict"
80+
]
81+
}
82+
]
83+
}
3784
}
3885
],
3986
"references": [
@@ -56,6 +103,6 @@
56103
],
57104
"database_specific": {
58105
"url": "https://pkg.go.dev/vuln/GO-2024-3339",
59-
"review_status": "UNREVIEWED"
106+
"review_status": "REVIEWED"
60107
}
61108
}

‎data/reports/GO-2024-3101.yaml

+10-3
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,12 @@ modules:
1010
- introduced: 1.5.0
1111
- fixed: 1.5.1
1212
vulnerable_at: 1.5.0
13-
summary: 'CWA-2023-004: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm'
13+
summary: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm
14+
description: |-
15+
A specifically crafted Wasm file can cause the VM to consume excessive amounts
16+
of memory when compiling a contract. This can lead to high memory usage,
17+
slowdowns, potentially a crash and can poison a lock in the VM, preventing any
18+
further interaction with contracts.
1419
ghsas:
1520
- GHSA-75qh-gg76-p2w4
1621
references:
@@ -19,7 +24,9 @@ references:
1924
- web: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md
2025
- web: https://rustsec.org/advisories/RUSTSEC-2024-0366.html
2126
- web: https://www.certik.com/resources/blog/risk-and-security-enhancement-for-app-chains-an-in-depth-writeup-of-cwa-2023
27+
notes:
28+
- Could not determine exactly which Go packages are affected, so leaving whole module as affected out of caution.
2229
source:
2330
id: GHSA-75qh-gg76-p2w4
24-
created: 2024-12-20T10:04:11.705159-10:00
25-
review_status: NEEDS_REVIEW
31+
created: 2024-12-20T10:42:53.394291-10:00
32+
review_status: REVIEWED

‎data/reports/GO-2024-3339.yaml

+24-4
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,34 @@
11
id: GO-2024-3339
22
modules:
3+
- module: cosmossdk.io/x/tx
4+
versions:
5+
- fixed: 0.13.7
6+
vulnerable_at: 0.13.6
7+
packages:
8+
- package: cosmossdk.io/x/tx/decode
9+
symbols:
10+
- RejectUnknownFields
11+
derived_symbols:
12+
- Decoder.Decode
13+
- RejectUnknownFieldsStrict
314
- module: github.com/cosmos/cosmos-sdk
415
versions:
516
- fixed: 0.47.15
617
- introduced: 0.50.0-alpha.0
718
- fixed: 0.50.11
819
vulnerable_at: 0.50.10
20+
packages:
21+
- package: github.com/cosmos/cosmos-sdk/codec/types
22+
symbols:
23+
- interfaceRegistry.UnpackAny
24+
- package: github.com/cosmos/cosmos-sdk/codec/unknownproto
25+
symbols:
26+
- RejectUnknownFields
27+
derived_symbols:
28+
- RejectUnknownFieldsStrict
929
summary: |-
10-
ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a
11-
stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk
30+
Transaction decoding may result in a stack overflow or resource exhaustion in
31+
github.com/cosmos/cosmos-sdk
1232
ghsas:
1333
- GHSA-8wcc-m6j2-qxvm
1434
references:
@@ -18,5 +38,5 @@ references:
1838
- web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.11
1939
source:
2040
id: GHSA-8wcc-m6j2-qxvm
21-
created: 2024-12-17T08:21:26.241857-05:00
22-
review_status: NEEDS_REVIEW
41+
created: 2024-12-20T10:42:55.054352-10:00
42+
review_status: REVIEWED

0 commit comments

Comments
 (0)