CVE-2024-27094 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Attackers can read potentially dirty memory beyond input buffers in Base64 encoding, exposing sensitive data in smart contracts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27094?
CVE-2024-27094 is a medium-severity vulnerability in openzeppelin-contracts, published on 29 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Weakness: CWE-125
Which versions are affected by CVE-2024-27094?
8 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts npm | From 4.5.0 | 4.9.6 |
@openzeppelin/contracts npm | From 4.5.0 | 4.9.6 |
@openzeppelin/contracts npm | From 5.0.0-rc.0 | 5.0.2 |
@openzeppelin/contracts npm | From 5.0.0-rc.0 | 5.0.2 |
@openzeppelin/contracts-upgradeable npm | From 4.5.0 | 4.9.6 |
@openzeppelin/contracts-upgradeable npm | From 4.5.0 | 4.9.6 |
2 more packages
@openzeppelin/contracts-upgradeable npm | From 5.0.0-rc.0 | 5.0.2 |
@openzeppelin/contracts-upgradeable npm | From 5.0.0-rc.0 | 5.0.2 |
Products include Openzeppelin Contracts, Openzeppelin Contracts Upgradeable.
How do I fix CVE-2024-27094?
Upgrade @openzeppelin/contracts to a fixed version for your release line: 4.9.6 or 5.0.2.
Is CVE-2024-27094 being exploited?
There is no known exploitation of CVE-2024-27094 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
Sources
Also known as GHSA-9vx6-7xxf-x967.