CVE-2021-41264criticalCWE-665

CVE-2021-41264: falha crítica em openzeppelin-contracts

UUPSUpgradeable vulnerability in OpenZeppelin Contracts

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar openzeppelin-contracts+ Monitorar @openzeppelin/contracts

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.5%
OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
OpenZeppelin · openzeppelin-contracts
CVEs relacionadas — openzeppelin-contracts

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39167CRITICALTimelockController vulnerability in OpenZeppelin ContractsEPSS 1.6%CVE-2023-30541MEDIUMTransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsEPSS 0.8%CVE-2022-35915MEDIUMUnbounded gas consumption in @openzeppelin/contractsEPSS 0.8%CVE-2022-31198HIGHGovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsEPSS 0.8%CVE-2022-31170HIGH OpenZeppelin Contracts's ERC165Checker may revert instead of returning falseEPSS 0.8%CVE-2024-27094MEDIUMOpenZeppelin Contracts base64 encoding may read from potentially dirty memoryEPSS 0.8%