CVE-2022-35915

2022-08-0121:15:13

CWE-400

CWE-770

[email protected]

web.nvd.nist.gov

openzeppelin contracts

secure smart contract

eip-165

supportsinterface

gas consumption

v4.7.2

upgrade

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

39.2%

JSON

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

Affected configurations

Nvd

Node

openzeppelincontractsRange2.0.0–4.7.2node.js

openzeppelincontracts_upgradeableRange3.2.0–4.7.2node.js

openzeppelinopenzeppelin-ethRange2.0.0≥node.js

openzeppelinopenzeppelin-solidityRange2.0.0≥node.js

VendorProductVersionCPE
openzeppelincontracts*cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*
openzeppelincontracts_upgradeable*cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*
openzeppelinopenzeppelin-eth*cpe:2.3:a:openzeppelin:openzeppelin-eth:*:*:*:*:*:node.js:*:*
openzeppelinopenzeppelin-solidity*cpe:2.3:a:openzeppelin:openzeppelin-solidity:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
openzeppelin	contracts	*	cpe:2.3:a:openzeppelin:contracts::::::node.js::*
openzeppelin	contracts_upgradeable	*	cpe:2.3:a:openzeppelin:contracts_upgradeable::::::node.js::*
openzeppelin	openzeppelin-eth	*	cpe:2.3:a:openzeppelin:openzeppelin-eth::::::node.js::*
openzeppelin	openzeppelin-solidity	*	cpe:2.3:a:openzeppelin:openzeppelin-solidity::::::node.js::*