SB2022082612 - Multiple vulnerabilities in OpenZeppelin Contracts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022082612

SB2022082612 - Multiple vulnerabilities in OpenZeppelin Contracts

Published: August 26, 2022

Security Bulletin ID SB2022082612
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) undefined (CVE-ID: CVE-2022-35916)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to contracts using the cross chain utilies for Arbitrum L2, "CrossChainEnabledArbitrumL2" or "LibArbitrumL2", will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. A remote attacker can perform arbitrary action on the system.


2) Resource exhaustion (CVE-ID: CVE-2022-35915)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in an EIP-165 "supportsInterface" query. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


3) Incorrect calculation (CVE-ID: CVE-2022-31198)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an incorrect calculation in the "GovernorVotesQuorumFraction" module. A remote attacker can perform arbitrary action in the target system.


Remediation

Install update from vendor's website.

References