@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: GHSA-VRW4-W73R-6MM8...

@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +78 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0, =1.0.3, =0.5.0-alpha.0, =0.0.3, =1.5.14, =1.5.17, =1.5.59 and more Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +78 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0, =1.0.3, =0.5.0-alpha.0, =0.0.3, =1.5.14, =1.5.17, =1.5.59 and more Source cves: CVE-2021-39168 Source advisory: GHSA-VRW4-W73R-6MM8...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +2303 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =0.2.0, =1.0.0 and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +2303 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =0.2.0, =1.0.0 and more Source cves: CVE-2021-39167 Source advisory: GHSA-FG47-3C2X-M2WR...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +48 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +48 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: GHSA-FG47-3C2X-M2WR...

TimelockController vulnerability in OpenZeppelin Contracts

Impact A vulnerability in TimelockController allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open"...

Privilege Escalation

@openzeppelin/contracts is vulnerable to privilege escalation. The vulnerability exists due to the lack of sanitization of roles in the TimelockController function which allowed an actor with executor role to escalate privileges...

CVE-2021-39168

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

Code injection

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +2303 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =0.2.0, =1.0.0 and more Source cves: CVE-2021-39167 Source advisory: MEND:CVE-2021-39167...

CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +48 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: MEND:CVE-2021-39167...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +78 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.2-solc-0.7)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0, =1.0.3, =0.5.0-alpha.0, =0.0.3, =1.5.14, =1.5.17, =1.5.59 and more Source cves: CVE-2021-39168 Source advisory: MEND:CVE-2021-39168...

@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: MEND:CVE-2021-39168...

CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

PT-2021-22424

Name of the Vulnerable Software and Affected Versions OpenZeppelin versions prior to 4.3.1 OpenZeppelin versions prior to 3.4.2 OpenZeppelin versions prior to 3.4.2-solc-0.7 Description A vulnerability in TimelockController allowed an actor with the executor role to escalate privileges, gaining...

PT-2021-22425

Name of the Vulnerable Software and Affected Versions OpenZeppelin versions prior to 4.3.1 OpenZeppelin versions prior to 3.4.2 OpenZeppelin versions prior to 3.4.2-solc-0.7 Description A vulnerability in TimelockController allowed an actor with the executor role to escalate privileges, gaining...