CVE-2021-25835: Authentication bypass by capture-replay in github.com/cosmos/ethermint
Summary
CVE-2021-25835: Authentication bypass by capture-replay in github.com/cosmos/ethermint. Affects github.com/cosmos/ethermint versions < 0.4.1. Fixed in 0.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package github.com/cosmos/ethermint is a Go package that is part of the Cosmos Network. It is used for building applications that are compatible with the Ethereum Virtual Machine (EVM). Ethermint uses the same chainIDEpoch and signature schemes as Ethereum for compatibility. It enables developers to create decentralized applications (dApps) and smart contracts on the Cosmos Network. However, versions of Ethermint up to v0.4.0 are vulnerable to an authentication bypass vulnerability.
Vulnerability Detail
The vulnerability in Ethermint allows for a cross-chain transaction replay attack. This means that a verified signature in Ethereum is still valid in Ethermint with the same message content and chainIDEpoch. An attacker can exploit this vulnerability to bypass authentication and perform unauthorized transactions on the Ethermint network. This can lead to financial losses and compromise the integrity of the affected applications.
How To Fix
Minimum fixed version
0.4.1
This is the first release that contains the fix.
go get github.com/cosmos/ethermint@v0.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the package to mitigate the risk of exploitation.
Conclusion
The vulnerability in github.com/cosmos/ethermint allows for an authentication bypass by capture-replay attack. Upgrading to version 0.4.1 or later of the package is necessary to mitigate the risk. It is recommended to update all dependencies and ensure that applications using Ethermint are using the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cosmos/ethermint →
FAQ
Ethermint is a Go package used for building applications compatible with the Ethereum Virtual Machine (EVM) on the Cosmos Network.
A cross-chain transaction replay attack is when a verified signature in one blockchain is valid in another blockchain with the same message content and chainIDEpoch. This allows an attacker to replay transactions from one blockchain to another, bypassing authentication.
This vulnerability can lead to unauthorized transactions on the Ethermint network, resulting in financial losses for users and compromising the integrity of affected applications.
To fix this vulnerability, upgrade to version 0.4.1 or later of the github.com/cosmos/ethermint package and ensure that all dependencies are also updated.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cosmos/ethermint.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
