Out-of-bounds Read Affecting @openzeppelin/contracts package, versions >=4.5.0 <4.9.6 >=5.0.0-rc.0 <5.0.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-OPENZEPPELINCONTRACTS-6346765
- published 1 Mar 2024
- disclosed 29 Feb 2024
- credit Riley Holterhus
Introduced: 29 Feb 2024
CVE-2024-27094 Open this link in a new tabHow to fix?
Upgrade @openzeppelin/contracts to version 4.9.6, 5.0.2 or higher.
Overview
@openzeppelin/contracts is a library for contract development.
Affected versions of this package are vulnerable to Out-of-bounds Read due to the Base64.encode function. An attacker can corrupt the output by manipulating the extra bits that are kept between the encoding and padding when the input is not a multiple of 3, leading to parts of the memory beyond the input buffer being read.
Note: These conditions are more frequent in the following scenarios:
A bytes memory struct is allocated just after the input and the first bytes of it are non-zero.
The memory pointer is set to a non-empty memory location before allocating the input.