CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
An actor with the executor role in OpenZeppelin TimelockController can escalate privileges, requiring revocation of untrusted executor roles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39168?
CVE-2021-39168 is a critical vulnerability in openzeppelin-contracts-upgradeable, published on 26 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
Weakness: CWE-269
Which versions are affected by CVE-2021-39168?
4 open source packages ship an affected version, including @openzeppelin/contracts-upgradeable. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts-upgradeable npm | From 3.3.0 | 3.4.2 |
@openzeppelin/contracts-upgradeable npm | From 3.3.0 | 3.4.2 |
@openzeppelin/contracts-upgradeable npm | From 4.0.0 | 4.3.1 |
@openzeppelin/contracts-upgradeable npm | From 4.0.0 | 4.3.1 |
Products include Openzeppelin Contracts.
How do I fix CVE-2021-39168?
Upgrade @openzeppelin/contracts-upgradeable to a fixed version for your release line: 3.4.2 or 4.3.1.
Is CVE-2021-39168 being exploited?
There is no known exploitation of CVE-2021-39168 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts-upgradeable
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
- CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Sources
Also known as GHSA-vrw4-w73r-6mm8.