Vulnerability · Published Dec 21, 2021 · Assigned by GitHub_M
CVE-2021-43839Drainage of FeeCollector's Block Transaction Fees
High 7.5
In plain English
A high-severity security flaw in cronos from crypto-org-chain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/crypto-org-chain/cronos | 0.6.5 | GHSA-f854-hpxv-cw9r |
| Go | github.com/tharsis/ethermint | 0.10.0 | GHSA-f854-hpxv-cw9r |
| Go | github.com/tharsis/ethermint | 0.7.3 | GHSA-f854-hpxv-cw9r |
| Go | github.com/tharsis/evmos | no fix listed | GHSA-f854-hpxv-cw9r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| crypto-org-chain | cronos | < 0.6.5 |
Weakness: CWE-670 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N