CVE-2021-25835: Authentication Bypass by Capture-replay

February 15, 2022 (updated April 12, 2022)

Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables “cross-chain transaction replay” attack.

References

github.com/advisories/GHSA-x5f3-qmwj-4f84
github.com/cosmos/ethermint/issues/687
github.com/cosmos/ethermint/pull/692
github.com/cosmos/ethermint/releases/tag/v0.4.1
nvd.nist.gov/vuln/detail/CVE-2021-25835

Code Behaviors & Features

Detect and mitigate CVE-2021-25835 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →