| id: GO-2024-3279 |
| modules: |
| - module: cosmossdk.io/math |
| versions: |
| - fixed: 1.4.0 |
| vulnerable_at: 1.3.0 |
| packages: |
| - package: cosmossdk.io/math |
| symbols: |
| - LegacyDec.MulIntMut |
| - LegacyDec.AddMut |
| - LegacyDec.QuoMut |
| - LegacyDec.Unmarshal |
| - LegacyDec.SubMut |
| - LegacyNewDecFromStr |
| - LegacyDec.MulMut |
| - LegacyDec.QuoRoundupMut |
| - LegacyDec.Ceil |
| - LegacyDec.MulTruncateMut |
| - LegacyDec.MulRoundUpMut |
| - LegacyDec.MulInt64Mut |
| - LegacyDec.QuoTruncateMut |
| derived_symbols: |
| - LegacyDec.Add |
| - LegacyDec.ApproxRoot |
| - LegacyDec.ApproxSqrt |
| - LegacyDec.ImmutOp |
| - LegacyDec.ImmutOpInt |
| - LegacyDec.ImmutOpInt64 |
| - LegacyDec.Mul |
| - LegacyDec.MulInt |
| - LegacyDec.MulInt64 |
| - LegacyDec.MulRoundUp |
| - LegacyDec.MulTruncate |
| - LegacyDec.Power |
| - LegacyDec.PowerMut |
| - LegacyDec.Quo |
| - LegacyDec.QuoInt |
| - LegacyDec.QuoInt64 |
| - LegacyDec.QuoRoundUp |
| - LegacyDec.QuoTruncate |
| - LegacyDec.Sub |
| - LegacyDec.UnmarshalAmino |
| - LegacyDec.UnmarshalJSON |
| - LegacyDecApproxEq |
| - LegacyMustNewDecFromStr |
| summary: Mismatched bit-length validation in can lead to panic in cosmossdk.io/math |
| ghsas: |
| - GHSA-7225-m954-23v7 |
| references: |
| - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7 |
| - fix: https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862 |
| source: |
| id: GHSA-7225-m954-23v7 |
| created: 2024-12-12T14:35:45.296697-05:00 |
| review_status: REVIEWED |
