{"id":"CVE-2024-32873","published":"2024-06-06T18:13:54Z","modified":"2024-08-02T02:20:35Z","title":"evmos allows transferring unvested tokens after delegations","vendor":"evmos","product":"evmos","tier":"tail","description":{"text":"Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens.  This vulnerability is fixed in 18.0.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.5,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00384,"percentile":0.32493,"provenance":"source"},"cwes":[{"id":"CWE-682","name":"Incorrect Calculation"}],"references":[{"url":"https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb","tags":["x_refsource_MISC"]}],"priority":{"score":8.9,"factors":[{"name":"EPSS percentile","points":6.5},{"name":"CVSS severity","points":2.45}]},"vendorSlug":"evmos","affectedVersions":[{"vendor":"evmos","product":"evmos","versions":["< 18.0.0"]}],"affected":[{"ecosystem":"Go","package":"github.com/evmos/evmos/v17","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v16","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v15","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v14","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v13","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v12","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v11","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v10","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v9","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v8","vulnerableRanges":["<18.0.0","all versions"],"patched":["18.0.0"],"from":["GHSA-pxv8-qhrh-jc7v","GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2129","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-evmos-cve-2024-32873","children":[{"from":"CVE-2024-32873","to":"CVE-2024-37158","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-pxv8-qhrh-jc7v","via":"reference","url":"https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"}]},{"from":"CVE-2024-32873","to":"CVE-2024-37159","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-pxv8-qhrh-jc7v","via":"reference","url":"https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"}]}],"packageHistory":[{"cve":"CVE-2024-32873","published":"2024-06-06","fixed":"18.0.0","kev":false},{"cve":"CVE-2024-37153","published":"2024-06-06","fixed":"18.1.0","kev":false,"link":{"from":"CVE-2024-32873","to":"CVE-2024-37153","relation":"successor","confidence":"high","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/evmos/evmos/v17","fromFixed":"18.0.0","toFixed":"18.1.0","daysApart":0},{"kind":"version-step","provenance":"source","package":"Go:github.com/evmos/evmos/v16","fromFixed":"18.0.0","toFixed":"18.1.0","daysApart":0},{"kind":"same-code","provenance":"machine","files":["x/evm/keeper/precompiles.go"],"commits":["https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb","https://github.com/evmos/evmos/commit/478b7a62e7af57a70cf3a01126c7f5a89bee69d7"],"basis":"shared file"}]}}],"package":"Go:github.com/evmos/evmos/v17"}}