CVE-2023-49798: falha de média gravidade em openzeppelin-contracts
Duplicated execution of subcalls in OpenZeppelin Contracts
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.5%
OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/contracts@4.9.4` and `@openzeppelin/contracts-upgradeable@4.9.4`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
OpenZeppelin · openzeppelin-contractsCVEs relacionadas — openzeppelin-contracts
No mesmo produto, das mais perigosas para as menos.
CVE-2021-39167CRITICALTimelockController vulnerability in OpenZeppelin ContractsEPSS 1.6%CVE-2021-41264CRITICALUUPSUpgradeable vulnerability in OpenZeppelin ContractsEPSS 1.5%CVE-2023-30541MEDIUMTransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsEPSS 0.8%CVE-2022-35915MEDIUMUnbounded gas consumption in @openzeppelin/contractsEPSS 0.8%CVE-2022-31198HIGHGovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsEPSS 0.8%CVE-2022-31170HIGH OpenZeppelin Contracts's ERC165Checker may revert instead of returning falseEPSS 0.8%