GHSA-g4vp-m682-qqmp

    Dashboard / Vulnerabilities / GHSA-g4vp-m682-qqmp

    GHSA-g4vp-m682-qqmp

    Published: 11 Aug 2023Last Modified: 8 Nov 2023

    Summary: OpenZeppelin Contracts vulnerable to Improper Escaping of Output

    Details: ### Impact OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. ### Patches The problem has been patched in v4.9.3.

    References: https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp, https://nvd.nist.gov/vuln/detail/CVE-2023-40014, https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481, https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484, https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd, https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5, https://github.com/OpenZeppelin/openzeppelin-contracts, https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.3/CHANGELOG.md, https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3

    Affected packages

    Package

    Name: @openzeppelin/contracts

    Purl: pkg:npm/%40openzeppelin/contracts

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 4.0.0
    Fixed -4.9.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-g4vp-m682-qqmp | CVE-DB