CVE-2021-25834: Authentication Bypass by Capture-replay

February 15, 2022 (updated April 12, 2022)

Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.

References

github.com/advisories/GHSA-93p5-8fqw-wjx3
github.com/cosmos/ethermint/commit/d7bdbd7488644f0aaeee5cdcdc119c863f199f72
github.com/cosmos/ethermint/issues/686
github.com/cosmos/ethermint/releases/tag/v0.4.1
nvd.nist.gov/vuln/detail/CVE-2021-25834

Code Behaviors & Features

Detect and mitigate CVE-2021-25834 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →