CVE-2022-31170: falha de alta gravidade em openzeppelin-contracts
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.8%
OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1. The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting. The issue was patched in version 4.7.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
OpenZeppelin · openzeppelin-contractsCVEs relacionadas — openzeppelin-contracts
No mesmo produto, das mais perigosas para as menos.
CVE-2021-39167CRITICALTimelockController vulnerability in OpenZeppelin ContractsEPSS 1.6%CVE-2021-41264CRITICALUUPSUpgradeable vulnerability in OpenZeppelin ContractsEPSS 1.5%CVE-2023-30541MEDIUMTransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsEPSS 0.8%CVE-2022-35915MEDIUMUnbounded gas consumption in @openzeppelin/contractsEPSS 0.8%CVE-2022-31198HIGHGovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsEPSS 0.8%CVE-2024-27094MEDIUMOpenZeppelin Contracts base64 encoding may read from potentially dirty memoryEPSS 0.8%