NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🦀
🦀 crates.io🐹 Go
Not in CISA KEV
MEDIUM severity

Gas mispricing in cosmwasm-vmGHSA-rg2q-2jh9-447q

MEDIUMFix: CosmWasm/cosmwasm@5bef1c5

GHSA-rg2q-2jh9-447q is a medium-severity (CVSS 4.3) vulnerability in cosmwasm-vm. A fix is available for cosmwasm-vm — see the affected versions and patch details below.

Also known asRUSTSEC-2024-0361
Published
Updated
Affected
6 pkgs
Patched
6 / 6
Exploits
None indexed
Exploitation data as of Aug 8, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

6 pkgs affected
🦀cosmwasm-vm🦀cosmwasm-vm🦀cosmwasm-vm🐹github.com/CosmWasm/wasmvm/v2🐹github.com/CosmWasm/wasmvm/v2🐹github.com/CosmWasm/wasmvm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

See CWA-2024-004 for more details.

Affected Packages

6 total 6 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.iocosmwasm-vmall versions1.5.6cargo update -p cosmwasm-vm --precise 1.5.6
🦀crates.iocosmwasm-vm≥ 2.0.0&&< 2.0.52.0.5cargo update -p cosmwasm-vm --precise 2.0.5
🦀crates.iocosmwasm-vm≥ 2.1.0&&< 2.1.22.1.2cargo update -p cosmwasm-vm --precise 2.1.2
🐹Gogithub.com/CosmWasm/wasmvm/v2≥ 2.1.0&&< 2.1.22.1.2go get github.com/CosmWasm/wasmvm/v2@v2.1.2
🐹Gogithub.com/CosmWasm/wasmvm/v2≥ 2.0.0&&< 2.0.32.0.3go get github.com/CosmWasm/wasmvm/v2@v2.0.3
🐹Gogithub.com/CosmWasm/wasmvmall versions1.5.4go get github.com/CosmWasm/wasmvm@v1.5.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for cosmwasm-vm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update cosmwasm-vm to 1.5.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rg2q-2jh9-447q is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

**Component:** wasmvm **Criticality:** Medium ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Moderate; L:Likely) **Patched versions:** wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the [gas target](https://github.com/CosmWasm/cosmwasm/blob/e50490c4199a234200a497219b27f071c3409f58/docs/GAS.md#cosmwasm-gas-pricing) we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temp
O3 Security · Impact-Aware SCA

Is GHSA-rg2q-2jh9-447q in your dependencies?

Find it across crates.io, Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Gas mispricing in cosmwasm-vm (Medium 4.3)