{"answers":{"affected":"3 open source packages ship an affected version, including cosmossdk.io/math.","exploited":"There is no known exploitation of GHSA-7225-m954-23v7 in the wild and no public exploit code.","fix":"Upgrade cosmossdk.io/math to 1.4.0 or later.","what":"GHSA-7225-m954-23v7 is a denial of service vulnerability in cosmossdk.io/math, published on 20 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-7225-m954-23v7 and fix it if it is affected.\n\nWhat it is: GHSA-7225-m954-23v7 is a denial of service vulnerability in cosmossdk.io/math, published on 20 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-7225-m954-23v7 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- cosmossdk.io/math (Go): affected all versions; fixed in 1.4.0\n- cosmossdk.io/math (Go): affected all versions; fixed in 1.4.0\n- cosmossdk.io/math (Go): affected all versions; fixed in 1.4.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7225-m954-23v7/ (Markdown: https://insights.sbomify.com/GHSA-7225-m954-23v7/index.md)","id":"GHSA-7225-m954-23v7","markdown":"https://insights.sbomify.com/GHSA-7225-m954-23v7/index.md","name":"GHSA-7225-m954-23v7","record":{"aliases":["GO-2024-3279"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Cosmos SDK math library","requires_auth":"none","summary":"Attackers can cause a panic in Cosmos SDK chains by exploiting mismatched bit-length validation in math types, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Name: ASA-2024-010: Mismatched bit-length in `sdk.Int` and `sdk.Dec` can lead to panic \nComponent: Cosmos SDK / Math\nCriticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: `cosmossdk.io/math` package versions \u003c= `math/v1.3.0`\nAffected users: Chain Builders + Maintainers, Validators\n\n### Impact\n\nThe bit-length in `sdk.Int` and `sdk.Dec` are not aligned, which may present a possible panic condition when interacting with `Dec` types in an `Int` context. This issue was resolved by aligning the max size between the data types in the cosmossdk.io/math package.\n\nThis issue impacts consumers of the cosmossdk.io/math, which includes popular modules including IBC-Go and tokenfactory (permissionless). If your chain interacts with APIs in the cosmossdk.io/math package, or utilizes a module that consumes this library, it is advised to update to the latest version at the time of the patch release by updating your project's go.mod dependency for cosmossdk.io/math.\n\nThe patch can be applied without a hard-fork, and with a version bump in a chain's go.mod file like the following:\n\n#### `go.mod`\n\n```diff\n- cosmossdk.io/math v1.3.0\n+ cosmossdk.io/math v1.4.0\n```\n\n\u003e [!NOTE]  \n\u003e When on a lower version than cosmossdk.io/math v1.3.0, please do a coordinated upgrade before upgrading to \u003e= 1.3.0\n\n### Patches\n\nThe new release of `cosmossdk.io/math v1.4.0` resolves this issue.  Chains that utilize the cosmossdk.io/math library or modules that utilize the cosmossdk.io/math library should update to avoid this condition.\n\n### Timeline\n\n* October 31, 2024, 6:55pm UTC: Issue reported to the Cosmos Bug Bounty program\n* October 31, 2024, 8:56pm UTC: Issue triaged by Amulet on-call, and distributed to Core team\n* Nov 15, 2024, 2:12am PST: Core team completes patch for issue\n* Nov 19, 2024, 8:00am PST / 16:00 GMT: Pre-notification delivered\n* Nov 20, 2024, 8:00am PST / 16:00 GMT: Patch made available\n\nThis issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 31, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io).  For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic","id":"GHSA-7225-m954-23v7","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.4.0"],"introduced":["0"],"last_affected":[],"package":"cosmossdk.io/math","purl":null,"source":"GHSA-7225-m954-23v7"},{"ecosystem":"Go","fixed":["1.4.0"],"introduced":["0"],"last_affected":[],"package":"cosmossdk.io/math","purl":"pkg:golang/cosmossdk.io/math","source":"GHSA-7225-m954-23v7"},{"ecosystem":"Go","fixed":["1.4.0"],"introduced":["0"],"last_affected":[],"package":"cosmossdk.io/math","purl":"pkg:golang/cosmossdk.io/math","source":"GO-2024-3279"}],"products":null,"published":"2024-11-20","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can cause a panic in Cosmos SDK chains by exploiting mismatched bit-length validation in math types, leading to denial of service.","url":"https://insights.sbomify.com/GHSA-7225-m954-23v7/"}