GHSA-93p5-8fqw-wjx3

Authentication bypass by capture-replay in github.com/cosmos/ethermint

Source: GitHub Advisory Database (reviewed) High CVE-2021-25834

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/cosmos/ethermint	< 0.4.1	0.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application. ### Specific Go Packages Affected github.com/cosmos/ethermint/rpc/namespaces/eth

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25834 advisory
https://github.com/cosmos/ethermint/issues/686 web
https://github.com/cosmos/ethermint/commit/d7bdbd7488644f0aaeee5cdcdc119c863f199f72 web
https://github.com/cosmos/ethermint/releases/tag/v0.4.1 web