CVE-2021-41135

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41135
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41135.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41135
Aliases
Related
Published
2021-10-20T18:15:07.807Z
Modified
2026-03-13T22:14:17.480709Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includes a user-defined expiration time for when the authorization grant expires. In Grant.ValidateBasic(), that time is compared to the node’s local clock time. Any chain running an affected version of the SDK with the authz module enabled could be halted by anyone with the ability to send transactions on that chain. Recovery would require applying the patch and rolling back the latest block. Users are advised to update to version 0.44.2.

References

Affected packages

Git / github.com/cosmos/cosmos-sdk

Affected ranges

Type
GIT
Repo
https://github.com/cosmos/cosmos-sdk
Events
Introduced
3f8596c1955e40ef30e4abcd06f2237d132db3a9
Fixed
68ab790a761e80d3674f821794cf18ccbfed45ee
Database specific 
{
    "versions": [
        {
            "introduced": "0.43.0"
        },
        {
            "fixed": "0.44.2"
        }
    ]
}

Affected versions

v0.*
v0.43.0
v0.44.0
v0.44.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41135.json"