Out-of-bounds Read Affecting @openzeppelin/contracts package, versions >=4.5.0 <4.9.6 >=5.0.0-rc.0 <5.0.2


0.0
medium
0
10

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.05% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-OPENZEPPELINCONTRACTS-6346765
  • published 1 Mar 2024
  • disclosed 29 Feb 2024
  • credit Riley Holterhus

How to fix?

Upgrade @openzeppelin/contracts to version 4.9.6, 5.0.2 or higher.

Overview

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Out-of-bounds Read due to the Base64.encode function. An attacker can corrupt the output by manipulating the extra bits that are kept between the encoding and padding when the input is not a multiple of 3, leading to parts of the memory beyond the input buffer being read.

Note: These conditions are more frequent in the following scenarios:

  1. A bytes memory struct is allocated just after the input and the first bytes of it are non-zero.

  2. The memory pointer is set to a non-empty memory location before allocating the input.