| id: GO-2024-3339 |
| modules: |
| - module: cosmossdk.io/x/tx |
| versions: |
| - fixed: 0.13.7 |
| vulnerable_at: 0.13.6 |
| packages: |
| - package: cosmossdk.io/x/tx/decode |
| symbols: |
| - RejectUnknownFields |
| derived_symbols: |
| - Decoder.Decode |
| - RejectUnknownFieldsStrict |
| - module: github.com/cosmos/cosmos-sdk |
| versions: |
| - fixed: 0.47.15 |
| - introduced: 0.50.0-alpha.0 |
| - fixed: 0.50.11 |
| vulnerable_at: 0.50.10 |
| packages: |
| - package: github.com/cosmos/cosmos-sdk/codec/types |
| symbols: |
| - interfaceRegistry.UnpackAny |
| - package: github.com/cosmos/cosmos-sdk/codec/unknownproto |
| symbols: |
| - RejectUnknownFields |
| derived_symbols: |
| - RejectUnknownFieldsStrict |
| summary: |- |
| Transaction decoding may result in a stack overflow or resource exhaustion in |
| github.com/cosmos/cosmos-sdk |
| ghsas: |
| - GHSA-8wcc-m6j2-qxvm |
| references: |
| - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-8wcc-m6j2-qxvm |
| - fix: https://github.com/cosmos/cosmos-sdk/commit/c6b1bdcd5628e3e425a3f02881d3c7db1d7af653 |
| - web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.15 |
| - web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.11 |
| source: |
| id: GHSA-8wcc-m6j2-qxvm |
| created: 2024-12-20T10:42:55.054352-10:00 |
| review_status: REVIEWED |
