x/vulndb: potential Go vuln in github.com/evmos/evmos: CVE-2024-39696

[GoVulnBot]

Advisory CVE-2024-39696 references a vulnerability in the following Go modules:

Module
github.com/evmos/evmos

Description:
Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-39696
• FIX: evmos/evmos@0a620e1
• WEB: GHSA-q6hg-6m9x-5g9c

Cross references:

• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/tharsis/evmos/v5: GHSA-3fp5-2xwh-fxm6 #2715
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos/v13: GHSA-m99c-q26r-m7m7 #2731
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos/v11: GHSA-v6rw-hhgg-wc4x #2732
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos: CVE-2024-32873 #2891
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos: CVE-2024-37153 #2903
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos: CVE-2024-37154 #2904
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos: CVE-2024-37158 #2926
• Module github.com/evmos/evmos appears in issue x/vulndb: potential Go vuln in github.com/evmos/evmos: CVE-2024-37159 #2927

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/evmos/evmos
      vulnerable_at: 1.1.3
summary: CVE-2024-39696 in github.com/evmos/evmos
cves:
    - CVE-2024-39696
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39696
    - fix: https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf
    - web: https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c
source:
    id: CVE-2024-39696
    created: 2024-07-05T20:01:11.833439032Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/597158 mentions this issue: data/reports: add 7 unreviewed reports

[gopherbot]

Change https://go.dev/cl/601375 mentions this issue: data/reports: update 3 reports