CVE-2021-43839
High
Description
Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.
SeverityHigh
CVSS7.5
Exploit probability—
ProductCrypto Cronos
PublishedDec 21, 2021
First seenDec 21, 2021
Weakness typeCWE-670CWE-670
How to fix
Update
- crypto cronos0.6.5 or later
- crypto ethermint0.7.3 or later
- github.com/crypto-org-chain/cronos0.6.5 or later
- github.com/tharsis/ethermint0.10.0, 0.7.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto cronos | v < 0.6.5 | 0.6.5 |
| crypto ethermint | v < 0.7.3, 0.8.0 ≤ v ≤ 0.9.0 | 0.7.3 |
| crypto evmos | v ≤ 0.4.2 | — |
| github.com/crypto-org-chain/cronosGo | v < 0.6.5 | 0.6.5 |
| github.com/tharsis/ethermintGo | 0.8.0 ≤ v < 0.10.0, v < 0.7.3 | 0.10.0, 0.7.3 |
| github.com/tharsis/evmosGo | v ≤ 0.4.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.