CWA-2024-009 Severity Low (Marginal + Likely)[^1] Affected versions: wasmd < 0.53.1 Patched versions: wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used) Description of the bug (Blank for now. We'll add more detail once chains had a chance to upgrade.) Mitigations Apart from upgrading, it is recommended to not open the gRPC and REST APIs of validator nodes to the public internet. Use isolated and resource-constrained environments for running separate public RPC nodes instead. These can then easily be thrown away and replaced with new instances in case of problems. Applying the patch Official Wasmd patch The patch will be shipped in a wasmd release. You will also have to update libwasmvm if you build statically. If you already use the latest / close to latest wasmd, you can update more or less as follows: Check the current wasmd version: go list -m github.com/CosmWasm/wasmd Bump the github.com/CosmWasm/wasmd dependency in your go.mod to 0.53.2 (Cosmos SDK 0.50 compatible); go mod tidy; commit. If you use the static libraries libwasmvm_muslc.aarch64.a/libwasmvm_muslc.x86_64.a, make sure that you use the same version as your wasmvm version. Check the updated wasmd version: go list -m github.com/CosmWasm/wasmd and ensure you see 0.53.2. Follow your regular practices to deploy chain upgrades. To double check if the correct library version is loaded at runtime, use this query: <appd> query wasm libwasmvm-version. It must show 2.1.4. The patch is not…Read More