Cyber Resilience

CVE-2021-43839

High

Published: 21 December 2021

Published
21 December 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0029 52.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-43839 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Crypto Ethermint. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 47.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been…

more

patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

CWE(s)
CWE-670

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

crypto
cronos
≤ 0.6.5
crypto
ethermint
≤ 0.7.3 · 0.8.0 — 0.9.0
crypto
evmos
≤ 0.4.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References