# Upcoming CosmWasm security patch: Codename Cherry **URL:** \ **Category:** Security\ **Created:** [April 17, 2023, 7:42pm UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474 "2023-04-17T19:42:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![simon\_warta](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/simon_warta/32/1322_2.png) [@simon\_warta](https://forum.cosmos.network/u/simon_warta)\ **Post date:** [April 17, 2023, 7:42pm UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474/1 "2023-04-17T19:42:35Z")
Tomorrow, on Tuesday, April 18th at 17:00 Berlin time (15h UTC/ 8am Pacific Time) Confio will release a fix for a medium severity security issue in CosmWasm. The patch for this issue will be distributed and communicated via the regular CosmWasm release process. This issue impacts the availability of a chain running CosmWasm, and could allow for a malicious contract to trigger a crash that can halt the chain. Though chains that use CosmWasm with permissioned uploads or instantiation are not directly at risk, we advise chains that support permissionless contract instantiation to be prepared to apply the patch and to coordinate network upgrades as quickly as their processes allow to fully remediate the issue. The patch is not a consensus breaking security fix and can be applied in-place, and instructions will be provided to all maintainers tomorrow as part of the release process. We anticipate that the patch will be a simple, straightforward fix for chain maintainers as it is a matter of replacing one Go dependency and rebuilding the application. The incident is tracked as CWA-2023-002, codename Cherry 馃崚. ---
**Author:** ![jacobgadikian](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/jacobgadikian/32/6994_2.png) [@jacobgadikian](https://forum.cosmos.network/u/jacobgadikian)\ **Post date:** [April 18, 2023, 3:39pm UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474/2 "2023-04-18T15:39:37Z")
Thank you very much both for the patch, and for the disclosure of the patch. ---
**Author:** ![simon\_warta](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/simon_warta/32/1322_2.png) [@simon\_warta](https://forum.cosmos.network/u/simon_warta)\ **Post date:** [April 18, 2023, 3:52pm UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474/3 "2023-04-18T15:52:58Z")
See [advisories/CWA-2023-002.md at main 路 CosmWasm/advisories 路 GitHub](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-002.md) for how to upgrade. wasmvm 1.2.3 is ready: [Release v1.2.3 路 CosmWasm/wasmvm 路 GitHub](https://github.com/CosmWasm/wasmvm/releases/tag/v1.2.3) wasmvm 1.1.2 is ready: [Release v1.1.2 路 CosmWasm/wasmvm 路 GitHub](https://github.com/CosmWasm/wasmvm/releases/tag/v1.1.2) wasmvm 1.0.1 is ready: [Release v1.0.1 路 CosmWasm/wasmvm 路 GitHub](https://github.com/CosmWasm/wasmvm/releases/tag/v1.0.1) ~~The other ones are built right now.~~ ---
**Author:** ![simon\_warta](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/simon_warta/32/1322_2.png) [@simon\_warta](https://forum.cosmos.network/u/simon_warta)\ **Post date:** [April 18, 2023, 5:29pm UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474/4 "2023-04-18T17:29:54Z")
If someone if hitting segmentation faults after applying the patch, please note this: [Add section "Wasm module cache issue" 路 CosmWasm/advisories@9832abb 路 GitHub](https://github.com/CosmWasm/advisories/commit/9832abb90155623f239407c2ef7d5667925e34bb) ---
**Author:** ![simon\_warta](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/simon_warta/32/1322_2.png) [@simon\_warta](https://forum.cosmos.network/u/simon_warta)\ **Post date:** [June 19, 2023, 9:50am UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474/5 "2023-06-19T09:50:57Z")
A description of the vulnerability was added to [CWA-2023-002](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-002.md). Also check out the detailed issue description published by the reporters from Jump Crypto: [Stop the Chain! CosmWasm Stack Overflow](https://jumpcrypto.com/writing/stop-the-chain-cosmwasm-stack-overflow/). As far as I can see all affected systems got the chance to fix their systems in time. Cheers ---
**Author:** ![jacobgadikian](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/jacobgadikian/32/6994_2.png) [@jacobgadikian](https://forum.cosmos.network/u/jacobgadikian)\ **Post date:** [June 19, 2023, 8:43pm UTC](https://forum.cosmos.network/t/upcoming-cosmwasm-security-patch-codename-cherry/10474/6 "2023-06-19T20:43:00Z")
imo both Jump and Confio did highly praiseworthy work here.