Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS01dnAzLXY0aGMtZ3g3Ns0VxA
UUPSUpgradeable vulnerability in @openzeppelin/contracts
Impact
Upgradeable contracts using UUPSUpgradeable
may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.
Patches
A fix is included in version 4.3.2 of @openzeppelin/contracts
and @openzeppelin/contracts-upgradeable
.
Workarounds
Initialize implementation contracts using UUPSUpgradeable
by invoking the initializer function (usually called initialize
). An example is provided in the forum.
References
For more information
If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at [email protected].
Permalink: https://github.com/advisories/GHSA-5vp3-v4hc-gx76JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01dnAzLXY0aGMtZ3g3Ns0VxA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: about 1 year ago
CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-5vp3-v4hc-gx76, CVE-2021-41264
References:
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76
- https://nvd.nist.gov/vuln/detail/CVE-2021-41264
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592
- https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301
- https://github.com/advisories/GHSA-5vp3-v4hc-gx76
Blast Radius: 44.5
Affected Packages
npm:@openzeppelin/contracts-upgradeable
Dependent packages: 853Dependent repositories: 4,919
Downloads: 565,440 last month
Affected Version Ranges: >= 4.1.0, < 4.3.2
Fixed in: 4.3.2
All affected versions: 4.1.0, 4.2.0, 4.3.0, 4.3.1
All unaffected versions: 3.2.0, 3.3.0, 3.4.0, 3.4.1, 3.4.2, 4.0.0, 4.3.2, 4.3.3, 4.4.0, 4.4.1, 4.4.2, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.8.0, 4.8.1, 4.8.2, 4.8.3, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 5.0.0, 5.0.1, 5.0.2
npm:@openzeppelin/contracts
Dependent packages: 3,207Dependent repositories: 34,743
Downloads: 1,495,327 last month
Affected Version Ranges: >= 4.1.0, < 4.3.2
Fixed in: 4.3.2
All affected versions: 4.1.0, 4.2.0, 4.3.0, 4.3.1
All unaffected versions: 2.3.0, 2.4.0, 2.5.0, 2.5.1, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.1, 3.4.2, 4.0.0, 4.3.2, 4.3.3, 4.4.0, 4.4.1, 4.4.2, 4.5.0, 4.6.0, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.8.0, 4.8.1, 4.8.2, 4.8.3, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 5.0.0, 5.0.1, 5.0.2