CVE-2024-27094

OpenZeppelin Contracts is a library for secure smart contract development. The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1505 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts (>=4.5.0, <=4.9.5)

@openzeppelin/contracts NPM version =4.5.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2024-27094 Source advisory: OSV:GHSA-9VX6-7XXF-X967...

@1inch/calldata-compressor (>=0.0.6, <=0.0.7), @1inch/delegating (>=1.1.0, <=2.0.0) +30 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts (>=5.0.0, <=5.0.1)

@openzeppelin/contracts NPM version =5.0.0, =0.0.6, =1.1.0, =3.2.0, =4.0.0-prerelease-16, =4.0.1, =2.0.0-prerelease, =3.3.0, =1.2.0, =0.0.1, =2.0.0-rc.0, =0.0.2-00080dc-272, =1.0.0, =1.1.3 and more Source cves: CVE-2024-27094 Source advisory: OSV:GHSA-9VX6-7XXF-X967...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +433 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=4.5.0, <=4.9.5)

@openzeppelin/contracts-upgradeable NPM version =4.5.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2024-27094 Source advisory:...

CVE-2024-27094 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

OpenZeppelin Contracts is a library for secure smart contract development. The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The...

CVE-2024-27094 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

OpenZeppelin Contracts is a library for secure smart contract development. The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The...

CVE-2024-27094

OpenZeppelin Contracts Base64.encode has a memory-read flaw when input length is not a multiple of 3, risking corruption of the encoded output. This affects OpenZeppelin Contracts (and upgradeable) prior to versions 5.0.2 and 4.9.6. Remediation: upgrade to 5.0.2 or 4.9.6. No exploit details are p...