Vulnerability · Published Nov 12, 2021 · Assigned by GitHub_M
CVE-2021-41264UUPSUpgradeable vulnerability in OpenZeppelin Contracts
Critical 9.8
In plain English
A critical-severity security flaw in openzeppelin-contracts from OpenZeppelin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @openzeppelin/contracts | 4.3.2 | GHSA-5vp3-v4hc-gx76 |
| npm | @openzeppelin/contracts-upgradeable | 4.3.2 | GHSA-5vp3-v4hc-gx76 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenZeppelin | openzeppelin-contracts | >= 4.1.0 < 4.3.2 |
Weakness: CWE-665 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76 x_refsource_CONFIRM
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592 x_refsource_MISC
- https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301 x_refsource_MISC