CVE-2021-41153: Specification non-compliance in JUMPI
rust-blockchain · evm
Affected: rust-blockchain evm · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 64% of scored CVEs
DescriptionCVE.org
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a high severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`. This is a low severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is not recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- rust-blockchain · evm< 0.31.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- October 2021
CoverageNo articles yet
No CyberSIXT article names CVE-2021-41153 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.