{"id":"GHSA-pvh2-pj76-4m96","summary":"Specification non-compliance in JUMPI","details":"### Impact \n\nIn `evm` crate `\u003c 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check.\n\n### Patches\n\nThis is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`.\n\nThis is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.\n\n### Workarounds\n\nIf you are dependent on an older version of `evm` and cannot update due to API interface changes, please contact Wei by email (wei@that.world), who will be happy to help you to publish patch releases for older `evm` versions.\n\n### References\n\nFix PR: https://github.com/rust-blockchain/evm/pull/67\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in the `evm` repo.\n\n### Special thanks\n\nSpecial thanks to @rakita for reporting this issue.\n","aliases":["CVE-2021-41153"],"modified":"2026-05-04T08:46:04.410594935Z","published":"2021-10-19T15:28:35Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-10-18T21:06:02Z","nvd_published_at":"2021-10-18T21:15:00Z","cwe_ids":["CWE-670"]},"references":[{"type":"WEB","url":"https://github.com/rust-blockchain/evm/security/advisories/GHSA-pvh2-pj76-4m96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41153"},{"type":"WEB","url":"https://github.com/rust-blockchain/evm/pull/67"},{"type":"PACKAGE","url":"https://github.com/rust-blockchain/evm"}],"affected":[{"package":{"name":"evm","ecosystem":"crates.io","purl":"pkg:cargo/evm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-pvh2-pj76-4m96/GHSA-pvh2-pj76-4m96.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"}]}