GitHub Advisoryadvisory · Go

GHSA-79xg-q4qm-7v9w CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error

HIGH Published 2025-06-11 Modified 2025-06-11 Official page ↗
Ecosystem
Go
Packages
github.com/CosmWasm/wasmd
Severity
High
Reviewed
2025-06-11

Affected packages

• Go github.com/CosmWasm/wasmd: >= 0.60.0, < 0.60.1 → fixed in 0.60.1 • Go github.com/CosmWasm/wasmd: >= 0.55.0, < 0.55.1 → fixed in 0.55.1 • Go github.com/CosmWasm/wasmd: >= 0.54.0, < 0.54.1 → fixed in 0.54.1 • Go github.com/CosmWasm/wasmd: >= 0.51.0, < 0.53.3 → fixed in 0.53.3

Description

CWA-2025-006: Improper error handling may lead to IBC channel opening despite error Severity High (Considerable + Likely)[^1] Affected versions: • wasmd 0.60.0 • wasmd >= 0.51.0 . Timeline • 2025-03-03: Auditor informs Confio about this issue. • 2025-04-10: Confio developed the patch internally. • 2025-06-05: Upcoming patch is announced. • 2025-06-10: Patch is released. [^1]: following Amulet's Severity Classification Framework ACMv1.2:

References