GHSA-75qh-gg76-p2w4: CWA-2023-004: Excessive number of function parameters in compiled Wasm
(updated )
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts.
For more information, see CWA-2023-004.
References
- forum.cosmos.network/t/high-severity-security-patch-upcoming-on-wed-10th-cwa-2023-004-brought-to-you-by-certik-and-confio/12840
- github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md
- github.com/advisories/GHSA-75qh-gg76-p2w4
- rustsec.org/advisories/RUSTSEC-2024-0366.html
- www.certik.com/resources/blog/risk-and-security-enhancement-for-app-chains-an-in-depth-writeup-of-cwa-2023
Code Behaviors & Features
Detect and mitigate GHSA-75qh-gg76-p2w4 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →