GO-2024-2715
Evmos transaction execution not accounting for all state transition after interaction with precompiles in github.com/evmos/evmos
Quick fix
GO-2024-2715 — github.com/evmos/evmos/v17: upgrade to the fixed version with the command below.
go get github.com/evmos/evmos/v17@v17.0.0Details
Evmos transaction execution not accounting for all state transition after interaction with precompiles in github.com/evmos/evmos
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for github.com/evmos/evmos (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v2 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v3 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v4 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v5 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v6 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v7 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v8 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v9 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v10 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v11 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v12 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v13 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v14 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v15 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/evmos/evmos/v16 (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 17.0.0go get github.com/evmos/evmos/v17@v17.0.00No fixed version published yet for github.com/tharsis/evmos (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/tharsis/evmos/v2 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/tharsis/evmos/v3 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/tharsis/evmos/v4 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/tharsis/evmos/v5 (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2024-32644[ADVISORY]
- https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d1914829648b6a5f[FIX]
- https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/state_object.go#L53-L68[WEB]
- https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L33-L55[WEB]
- https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465[WEB]