x/vulndb: potential Go vuln in cosmossdk.io/math: GHSA-7225-m954-23v7

[GoVulnBot]

Advisory GHSA-7225-m954-23v7 references a vulnerability in the following Go modules:

Module
cosmossdk.io/math

Description:
Name: ASA-2024-010: Mismatched bit-length in sdk.Int and sdk.Dec can lead to panic
Component: Cosmos SDK / Math
Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2)
Affected versions: cosmossdk.io/math package versions <= math/v1.3.0
Affected users: Chain Builders + Maintainers, Validators

Impact

The bit-length in sdk.Int and sdk.Dec are not aligned, which may present a possible panic condition when interacting with Dec types in an Int context. This issue was ...

References:

• ADVISORY: GHSA-7225-m954-23v7
• ADVISORY: GHSA-7225-m954-23v7
• FIX: cosmos/cosmos-sdk@c6522a7

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: cosmossdk.io/math
      non_go_versions:
        - introduced: TODO (earliest fixed "1.4.0", vuln range "<= 1.3.0")
      vulnerable_at: 1.4.0
summary: |-
    ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and
    sdk.Dec can lead to panic
ghsas:
    - GHSA-7225-m954-23v7
references:
    - advisory: https://github.com/advisories/GHSA-7225-m954-23v7
    - advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7
    - fix: https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862
source:
    id: GHSA-7225-m954-23v7
    created: 2024-11-21T15:01:34.312644476Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/630756 mentions this issue: data/reports: add 2 needs review reports