What is GHSA-q4h9-46xg-m3x9?

GHSA-q4h9-46xg-m3x9 is a security advisory published by GitHub Security Advisories with Critical severity. UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable

Why does GHSA-q4h9-46xg-m3x9 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-q4h9-46xg-m3x9?

GHSA-q4h9-46xg-m3x9 affects 1 product, including: npm/@openzeppelin/contracts-upgradeable:\u003e= 4.1.0, \u003c 4.3.2.

GHSA-q4h9-46xg-m3x9CriticalDisclosed before NVD

UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable

Vendor

GitHub Security Advisories

Published

September 15, 2021

Last Modified

January 9, 2023

📋 Description

Impact

Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

Patches

A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.

Workarounds

Initialize implementation contracts using UUPSUpgradeable by invoking the initializer function (usually called initialize). An example is provided in the forum.

References

A post-mortem will be published in a few days in the OpenZeppelin Forum.

For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at [email protected].

🎯 Affected products1

npm/@openzeppelin/contracts-upgradeable:>= 4.1.0, < 4.3.2