Vulnerability · Published Jun 17, 2024 · Assigned by GitHub_M
CVE-2024-37159Evmos is missing create validator check
Low 3.5
In plain English
A low-severity security flaw in evmos from evmos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 75.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/evmos/evmos | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v10 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v10 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v10 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v10 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v11 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v11 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v11 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v11 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v12 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v12 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v12 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v12 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v13 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v13 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v13 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v13 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v14 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v14 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v14 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v14 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v15 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v15 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v15 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v15 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v16 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v16 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v16 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v16 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v17 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v17 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v17 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v17 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v18 | 18.0.0 | GO-2024-2927 |
| Go | github.com/evmos/evmos/v18 | 18.0.0 | GO-2024-2891 |
| Go | github.com/evmos/evmos/v18 | 18.0.0 | GO-2024-2926 |
| Go | github.com/evmos/evmos/v2 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v2 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v2 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v3 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v3 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v3 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v4 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v4 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v4 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v5 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v5 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v5 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v6 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v6 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v6 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v6 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v7 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v7 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v7 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v7 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v8 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v8 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v8 | no fix listed | GO-2024-2927 |
| Go | github.com/evmos/evmos/v8 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v9 | no fix listed | GO-2024-2891 |
| Go | github.com/evmos/evmos/v9 | no fix listed | GO-2024-2926 |
| Go | github.com/evmos/evmos/v9 | 18.0.0 | GHSA-pxv8-qhrh-jc7v |
| Go | github.com/evmos/evmos/v9 | no fix listed | GO-2024-2927 |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v x_refsource_CONFIRM
- https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb x_refsource_MISC