CVE-2022-39393

Advisory

Wasmtime 3.0.0 (Python bindings) downloads a precompiled version of Wastime core that includes security fixes.
https://github.com/bytecodealliance/wasmtime-py/commit/18a742a3457d6edfab7e96af466721e19d2e12cd

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Released 2022-11-10.

Fixed

* [CVE-2022-39392] - modules may perform out-of-bounds reads/writes when the
pooling allocator was configured with `memory_pages: 0`.

* [CVE-2022-39393] - data can be leaked between instances when using the pooling
allocator.

* [CVE-2022-39394] - An incorrect Rust signature for the C API
`wasmtime_trap_code` function could lead to an out-of-bounds write of three
zero bytes.

[CVE-2022-39392]: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-44mr-8vmm-wjhg
[CVE-2022-39393]: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf
[CVE-2022-39394]: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q

--------------------------------------------------------------------------------

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39393