What is GHSA-5vp3-v4hc-gx76?

GHSA-5vp3-v4hc-gx76 is a security advisory published by GitHub Security Advisories with Critical severity. UUPSUpgradeable vulnerability in @openzeppelin/contracts

Which CVE IDs does GHSA-5vp3-v4hc-gx76 cover?

GHSA-5vp3-v4hc-gx76 covers the following CVE IDs: CVE-2021-41264. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5vp3-v4hc-gx76?

GHSA-5vp3-v4hc-gx76 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-5vp3-v4hc-gx76?

GHSA-5vp3-v4hc-gx76 affects 2 products, including: npm/@openzeppelin/contracts:\u003e= 4.1.0, \u003c 4.3.2; npm/@openzeppelin/contracts-upgradeable:\u003e= 4.1.0, \u003c 4.3.2.

GHSA-5vp3-v4hc-gx76CriticalCVSS 9.8

UUPSUpgradeable vulnerability in @openzeppelin/contracts

Vendor

GitHub Security Advisories

Published

September 15, 2021

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2021-41264 →

📋 Description

Impact

Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

Patches

A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.

Workarounds

Initialize implementation contracts using UUPSUpgradeable by invoking the initializer function (usually called initialize). An example is provided in the forum.

References

Post-mortem.

For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at [email protected].

🎯 Affected products2

npm/@openzeppelin/contracts:>= 4.1.0, < 4.3.2
npm/@openzeppelin/contracts-upgradeable:>= 4.1.0, < 4.3.2