Lucene search
GoogleOSV:GHSA-X5F3-QMWJ-4F84HistoryFeb 15, 2022 - 1:57 a.m.
Authentication bypass by capture-replay in github.com/cosmos/ethermint
2022-02-1501:57:18
Google
osv.dev
9
0.001 Low
EPSS
Percentile
31.1%
Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables “cross-chain transaction replay” attack.
Specific Go Packages Affected
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/cosmos/ethermint | lt | 0.4.1 |
Related
github
github
Authentication bypass by capture-replay in github.com/cosmos/ethermint
2022-02-15 01:57:18
cve
cve
CVE-2021-25835
2021-02-08 18:15:13
osv
osv
CVE-2021-25835
2021-02-08 18:15:13
cvelist
cvelist
CVE-2021-25835
2021-02-08 17:57:19
nvd
nvd
CVE-2021-25835
2021-02-08 18:15:13
veracode
veracode
Cross-Chain Transaction Replay Attack
2021-02-09 03:30:25
prion
prion
Cross site scripting
2021-02-08 18:15:00