GHSA-rg2q-2jh9-447q Gas mispricing in cosmwasm-vm

• crates.io cosmwasm-vm: < 1.5.6 → fixed in 1.5.6 • crates.io cosmwasm-vm: >= 2.0.0, < 2.0.5 → fixed in 2.0.5 • crates.io cosmwasm-vm: >= 2.1.0, < 2.1.2 → fixed in 2.1.2 • Go github.com/CosmWasm/wasmvm/v2: >= 2.1.0, < 2.1.2 → fixed in 2.1.2 • Go github.com/CosmWasm/wasmvm/v2: >= 2.0.0, < 2.0.3 → fixed in 2.0.3 • Go github.com/CosmWasm/wasmvm: < 1.5.4 → fixed in 1.5.4

Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2 Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. See CWA-2024-004 for more details.