{"action":"Upgrade cosmossdk.io/math to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"cosmossdk.io/math","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-7225-m954-23v7","id":"tcs_01M5KF14XG777456DG82GKPGRX","modified_at":"2024-11-22T20:48:48Z","published_at":"2024-11-20T18:23:51Z","references":["https://osv.dev/vulnerability/GHSA-7225-m954-23v7","https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7","https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862","https://github.com/cosmos/cosmos-sdk","https://pkg.go.dev/vuln/GO-2024-3279"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-7225-m954-23v7","url":"https://osv.dev/vulnerability/GHSA-7225-m954-23v7"}],"summary":"ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic"}