@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: GHSA-VRW4-W73R-6MM8...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +78 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0, =1.0.3, =0.5.0-alpha.0, =0.0.3, =1.5.14, =1.5.17, =1.5.59 and more Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +78 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0, =1.0.3, =0.5.0-alpha.0, =0.0.3, =1.5.14, =1.5.17, =1.5.59 and more Source cves: CVE-2021-39168 Source advisory: GHSA-VRW4-W73R-6MM8...

TimelockController vulnerability in OpenZeppelin Contracts

Impact A vulnerability in TimelockController allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open"...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +48 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +2309 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =0.2.0, =1.0.0 and more Source cves: CVE-2021-39167 Source advisory: GHSA-FG47-3C2X-M2WR...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +2309 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =0.2.0, =1.0.0 and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +48 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: GHSA-FG47-3C2X-M2WR...

Privilege Escalation

@openzeppelin/contracts is vulnerable to privilege escalation. The vulnerability exists due to the lack of sanitization of roles in the TimelockController function which allowed an actor with executor role to escalate privileges...

CVE-2021-39168

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

Code injection

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +2309 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =0.2.0, =1.0.0 and more Source cves: CVE-2021-39167 Source advisory: MEND:CVE-2021-39167...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +48 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: MEND:CVE-2021-39167...

CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: MEND:CVE-2021-39168...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +78 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0, =1.0.3, =0.5.0-alpha.0, =0.0.3, =1.5.14, =1.5.17, =1.5.59 and more Source cves: CVE-2021-39168 Source advisory: MEND:CVE-2021-39168...

PT-2021-22425

Name of the Vulnerable Software and Affected Versions OpenZeppelin versions prior to 4.3.1 OpenZeppelin versions prior to 3.4.2 OpenZeppelin versions prior to 3.4.2-solc-0.7 Description A vulnerability in TimelockController allowed an actor with the executor role to escalate privileges, gaining...

OpenZepplin security vulnerabilities

OpenZepplin is a library for smart contract development. OpenZepplin has a security vulnerability that stems from a vulnerability in the TimelockController in the affected version that allows elevation of privilege for participants with the executor role...