GHSA-2q97-m5rc-p3gp CosmWasm VM Incorrect metering

• Go github.com/CosmWasm/wasmvm/v2: >= 2.1.0, < 2.1.3 → fixed in 2.1.3 • Go github.com/CosmWasm/wasmvm/v2: >= 2.0.0, < 2.0.4 → fixed in 2.0.4 • Go github.com/CosmWasm/wasmvm: < 1.5.5 → fixed in 1.5.5 • crates.io cosmwasm-vm: >= 2.1.0, < 2.1.4 → fixed in 2.1.4 • crates.io cosmwasm-vm: >= 2.0.0, < 2.0.7 → fixed in 2.0.7 • crates.io cosmwasm-vm: < 1.5.8 → fixed in 1.5.8

CWA-2024-007 Severity Medium (Moderate + Likely)[^1] Affected versions: • wasmvm >= 2.1.0, = 2.0.0, = 2.1.0, = 2.0.0, query wasm libwasmvm-version`. It must show 1.5.5, 2.0.4 or 2.1.3. The patch is consensus breaking and requires a coordinated upgrade. Acknowledgement This issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see . Timeline • 2024-08-28: Confio receives a report through the Cosmos bug bounty program maintained by Amulet. • 2024-08-30: Confio security contributors confirm the report. • 2024-09-02: Confio developed the patch internally. • 2024-09-23: Patch is released. [^1]: following Amulet's Severity Classification Framework ACMv1: https://github.com/interchainio/security/blob/e0227a1fb4059144aab4f6003eeee7f09912db3a/resources/CLASSIFICATION_MATRIX.md