CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2021-41264

CVSS 9.8v3.1pub. 2021-11-12upd. 2024-11-21

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Openzeppelin Contracts

    APP
    Openzeppelin
    4.1.0 – 4.3.2 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2021-39168CRITICAL10.0ten sam produkt

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockContr...

CVE-2021-39167CRITICAL10.0ten sam produkt

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockContr...

CVE-2022-35961HIGH7.9ten sam produkt

OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `...

CVE-2022-31198HIGH7.5ten sam produkt

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Go...

CVE-2022-31172HIGH7.5ten sam produkt

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable ...