GHSA-7grf-83vw-6f5xMediumCVSS 5.3

OpenZeppelin Contracts ERC165Checker unbounded gas consumption

Published
August 14, 2022
Last Modified
July 21, 2023

🔗 CVE IDs covered (1)

CVE-2022-35915 →

📋 Description

Impact

The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.

Patches

The issue has been fixed in v4.7.2.

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587

For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [email protected].

🎯 Affected products4

  • npm/@openzeppelin/contracts:>= 2.0.0, < 4.7.2
  • npm/openzeppelin-solidity:>= 2.0.0, <= 4.6.0
  • npm/@openzeppelin/contracts-upgradeable:>= 3.2.0, < 4.7.2
  • npm/openzeppelin-eth:>= 2.0.0, <= 2.2.0

🔗 References (5)