GHSA-7225-m954-23v7 ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic

• Go cosmossdk.io/math: < 1.4.0 → fixed in 1.4.0

Name: ASA-2024-010: Mismatched bit-length in `sdk.Int` and `sdk.Dec` can lead to panic Component: Cosmos SDK / Math Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2) Affected versions: `cosmossdk.io/math` package versions [!NOTE] > When on a lower version than cosmossdk.io/math v1.3.0, please do a coordinated upgrade before upgrading to >= 1.3.0 Patches The new release of `cosmossdk.io/math v1.4.0` resolves this issue. Chains that utilize the cosmossdk.io/math library or modules that utilize the cosmossdk.io/math library should update to avoid this condition. Timeline • October 31, 2024, 6:55pm UTC: Issue reported to the Cosmos Bug Bounty program • October 31, 2024, 8:56pm UTC: Issue triaged by Amulet on-call, and distributed to Core team • Nov 15, 2024, 2:12am PST: Core team completes patch for issue • Nov 19, 2024, 8:00am PST / 16:00 GMT: Pre-notification delivered • Nov 20, 2024, 8:00am PST / 16:00 GMT: Patch made available This issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 31, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos. If you have questions about Interchain security efforts, please reach out to our official communication channel at [email protected]. For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.