x/vulndb: potential Go vuln in github.com/CosmWasm/wasmd: GHSA-vmg2-r3xv-r3xf

[GoVulnBot]

Advisory GHSA-vmg2-r3xv-r3xf references a vulnerability in the following Go modules:

Module
github.com/CosmWasm/wasmd

Description:

CWA-2024-009

Severity

Low (Marginal + Likely)[^1]

Affected versions:

• wasmd < 0.53.1

Patched versions:

• wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used)

Description of the bug

(Blank for now. We'll add more detail once chains had a chance to upgrade.)

Mitigations

Apart from upgrading, it is recommended to not open the gRPC and REST APIs of validator nodes to the public internet. Use isolated and resource-constrained environments for running separate public RPC nodes instead.
These can then easily be thrown away and replaced with ...

References:

• ADVISORY: GHSA-vmg2-r3xv-r3xf
• ADVISORY: GHSA-vmg2-r3xv-r3xf

Cross references:

• github.com/CosmWasm/wasmd appears in 3 other report(s):
  • data/reports/GO-2024-3059.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmd: GHSA-m3rh-cvr5-x6q4 #3059)
  • data/reports/GO-2024-3081.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmd: GHSA-fpgj-cr28-fvpx #3081)
  • data/reports/GO-2024-3082.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmd: GHSA-g8w7-7vgg-x7xg #3082)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/CosmWasm/wasmd
      versions:
        - fixed: 0.53.2
      vulnerable_at: 0.53.1
summary: Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd
ghsas:
    - GHSA-vmg2-r3xv-r3xf
references:
    - advisory: https://github.com/CosmWasm/wasmd/security/advisories/GHSA-vmg2-r3xv-r3xf
    - advisory: https://github.com/advisories/GHSA-vmg2-r3xv-r3xf
source:
    id: GHSA-vmg2-r3xv-r3xf
    created: 2024-12-10T17:01:24.797031485Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/634920 mentions this issue: data/reports: add 2 unreviewed reports