Detections
Analytics

SCA: security update for github.com/Kava-Labs/kava, github.com/crypto-org-chain/cronos, github.com/evmos/ethermint, github.com/evmos/evmos (GHSA-f92v-grc2-w2fg)

medium Tenable Cloud Security Plugin ID 414406

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract
 `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database
 storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical
 bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`,
 even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been
 patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using
 Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is
 subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode,
 so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash
 -> bytecode` entry in the internal state. (CVE-2022-35936)

See Also

https://github.com/advisories/GHSA-f92v-grc2-w2fg

Plugin Details

Severity: Medium

ID: 414406

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-35936

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/18/2022

Vulnerability Publication Date: 8/5/2022

Reference Information

CVE: CVE-2022-35936

cwe: CWE-668