CVE-2023-40014
OpenZeppelin Contracts is a library for secure smart contract development.
Does this matter?
Lower severity and a low EPSS score (0.74%). Track it; it rarely justifies an emergency change on its own.
Description
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.74% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-116
- Affected
- openzeppelin/openzeppelin contracts · openzeppelin/openzeppelin contracts-upgradable
- Source
- security-advisories@github.com
References
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcdPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5Patch
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481Patch, Vendor Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484Patch, Vendor Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3Release Notes
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmpVendor Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcdPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5Patch
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481Patch, Vendor Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484Patch, Vendor Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3Release Notes
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmpVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.