CWA-2024-006: wasmd non-deterministic module_query_safe query

published 2024-08-21 2y ago modified 2026-03-03 8mo ago also GO-2024-3081

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

**Component:** wasmd **Criticality:** Medium ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Moderate; L:Likely) **Patched versions:** wasmd 0.53.0

See [CWA-2024-006](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-006.md) for more details.

Patch / fix

fixed in 1 links 1

go github.com/CosmWasm/wasmd 0.53.0

github.com/CosmWasm/wasmd@db8981d commit

Is GHSA-fpgj-cr28-fvpx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/CosmWasm/wasmd	>=0.52.0, <0.53.0	0.53.0

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

github.com /CosmWasm/wasmd/commit/db8981db8419fc4daa042ce04e279efb53c4ff29
web, patch
github.com /CosmWasm/wasmd/security/advisories/GHSA-fpgj-cr28-fvpx
web, advisory
github.com /CosmWasm/advisories/blob/main/CWAs/CWA-2024-006.md
web
github.com /CosmWasm/wasmd
package

Sources

GitHub Advisory GHSA-fpgj-cr28-fvpx
OSV GO-2024-3081

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.