Description
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
bytecodealliance wasmtime
Default version status: unaffected
46.0.0 to < 48.0.4affected48.0.4unaffected49.0.0 to < 49.0.2affected49.0.2unaffected
pkg:cargo/wasmtime-wasi