GitHub Advisoryadvisory · Go
GHSA-2p6r-37p9-89p2 Authz Module Non-Determinism
MEDIUM
Official page ↗
- Aliases
- CVE-2021-41135
- Ecosystem
- Go
- Packages
- github.com/cosmos/cosmos-sdk
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-754
- Reviewed
- 2021-10-20
Affected packages
• Go github.com/cosmos/cosmos-sdk: >= 0.43.0, < 0.44.2 → fixed in 0.44.2
Description
Impact
Consensus failure for 0.43.x and 0.44.{0,1} users.
Funds and balances are safe.
Patches
0.44.2
Workarounds
Manually patch the code.
---
Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
Related
Alias · CVE (1)
- CVE-2021-41135 The Cosmos-SDK is a framework for building blockchain applications in Golang. vulnerability
Weakness · CWE (1)
- CWE-754 Improper Check for Unusual or Exceptional Conditions weakness
References
- https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2p6r-37p9-89p2 web
- https://nvd.nist.gov/vuln/detail/CVE-2021-41135 advisory
- https://github.com/cosmos/cosmos-sdk/commit/68ab790a761e80d3674f821794cf18ccbfed45ee web
- https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349 web
- https://github.com/cosmos/cosmos-sdk package
- https://github.com/cosmos/cosmos-sdk/releases/tag/v0.44.2 web