PT-2021-23970

CVE-2021-43839

·

Published

2021-12-21

·

Updated

2022-01-06

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Cronos versions prior to v0.6.5
Description: The issue allows an attacker to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. User funds and balances are safe.
Recommendations: For Cronos versions prior to v0.6.5, upgrade to Cronos v0.6.5 at the earliest possible convenience.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-670: Always-Incorrect Control Flow Implementation
Related identifiers
CVE-2021-43839
GHSA-F854-HPXV-CW9R
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com