CVE-2021-43839 (published 2021-12-21T17:15Z)

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-670
cwe_name: Always-Incorrect Control Flow Implementation
description: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
extended_description: This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.
         

Fix information:
repo_url: https://github.com/crypto-org-chain/cronos
commit_details: repo_url: https://github.com/crypto-org-chain/cronos
author: yihuang
author_date: 2021-12-21 11:43:18+08:00
msg: Problem: MsgEthereumTx wrapping tx without the extension option is not rejected (#270)

* reject MsgEthereumTx wrapping tx without the extension option.

reject MsgEthereumTx wrapping tx without the extension option.

update gomod2nix

try to build in CI

fix GOPRIVATE

fix mount

update to public ethermint

* update changelog

* v0.6.5
repository: repo_url: https://github.com/crypto-org-chain/cronos
repo_name: crypto-org-chain/cronos
description: Cronos is the first Ethereum-compatible blockchain network built on Cosmos SDK technology. Cronos aims to massively scale the DeFi, GameFi, and overall Web3 user community by providing builders with the ability to instantly port apps and crypto assets from other chains while benefiting from low transaction fees, high throughput, and fast finality.
repo_language: Go
owner: crypto-org-chain
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,11 @@
 # Changelog
 
-## Unreleased
+## v0.6.5
+
+### Bug Fixes
+
+- [cronos#255](https://github.com/crypto-org-chain/cronos/pull/255) fix empty topics in non-breaking way
+- [cronos#270](https://github.com/crypto-org-chain/cronos/pull/270) reject MsgEthereumTx wrapping tx without the extension option.
 
 *November 30, 2021*
 

programming_language: Markdown
filename: go.mod
change_type: ModificationType.MODIFY
diff: @@ -164,4 +164,4 @@ replace github.com/ethereum/go-ethereum => github.com/crypto-org-chain/go-ethere
 // TODO: remove when ibc-go and ethermint upgrades cosmos-sdk
 replace github.com/cosmos/cosmos-sdk => github.com/cosmos/cosmos-sdk v0.44.2
 
-replace github.com/tharsis/ethermint => github.com/crypto-org-chain/ethermint v0.7.2-cronos-4
+replace github.com/tharsis/ethermint => github.com/crypto-org-chain/ethermint v0.7.2-cronos-6

programming_language: Go
filename: go.sum
change_type: ModificationType.MODIFY
diff: @@ -261,8 +261,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:ma
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/crypto-org-chain/ethermint v0.7.2-cronos-4 h1:NaCc0L5zN2u7B9WofmhJfur23UDebWSRD+Goqf9URnY=
-github.com/crypto-org-chain/ethermint v0.7.2-cronos-4/go.mod h1:J96LX4KvLyl+5jV6+mt/4l6srtGX/mdDTuqQQuYrdDk=
+github.com/crypto-org-chain/ethermint v0.7.2-cronos-6 h1:AHmZ4d/VvRPYEwRK8WATDVgAW+LQLuus9/oRo8UHkB4=
+github.com/crypto-org-chain/ethermint v0.7.2-cronos-6/go.mod h1:J96LX4KvLyl+5jV6+mt/4l6srtGX/mdDTuqQQuYrdDk=
 github.com/crypto-org-chain/go-ethereum v1.10.3-patched h1:kr6oQIYOi2VC8SZwkhlUDZE1Omit/YHVysKMgCB2nes=
 github.com/crypto-org-chain/go-ethereum v1.10.3-patched/go.mod h1:99onQmSd1GRGOziyGldI41YQb7EESX3Q4H41IfJgIQQ=
 github.com/crypto-org-chain/ibc-go v1.2.1-hooks h1:wuWaQqm/TFKJQwuFgjCPiPumQio+Yik5Z1DObDExrrU=

programming_language: Go
filename: gomod2nix.toml
change_type: ModificationType.MODIFY
diff: @@ -4637,13 +4637,13 @@
     sha256 = "1kmdk3v2a6ygcg2i8jfgz61yzxi4183xgzlaviq9jwsqwc2hj60w"
 
 ["github.com/tharsis/ethermint"]
-  sumVersion = "v0.7.2-cronos-4"
+  sumVersion = "v0.7.2-cronos-6"
   vendorPath = "github.com/crypto-org-chain/ethermint"
   ["github.com/tharsis/ethermint".fetch]
     type = "git"
     url = "https://github.com/crypto-org-chain/ethermint"
-    rev = "82805507f7d2e83cad547736883dc22acfb52440"
-    sha256 = "01f9i8vq0jqml676wvh0kr9kxg7grqw7f64g1qd81pzm2n89k7pn"
+    rev = "60af027299c1aec580240d1e03d66c0ad100934b"
+    sha256 = "1074b5rbi1l0ija5iz4i9d92r1as030wkqllz5ga0ahhqrgb2rp9"
 
 ["github.com/tidwall/gjson"]
   sumVersion = "v1.6.7"

programming_language: Go