PT-2021-23225 · Openzeppelin · @Openzeppelin/Contracts-Upgradeable+1

Frangio · Published 2021-09-15 · Updated 2021-11-15 · CVE-2021-41264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @openzeppelin/contracts versions prior to 4.3.2 @openzeppelin/contracts-upgradeable versions prior to 4.3.2

Description The issue affects upgradeable contracts using UUPSUpgradeable in OpenZeppelin Contracts, a library for smart contract development. These contracts may be vulnerable to an attack affecting uninitialized implementation contracts.

Recommendations For versions prior to 4.3.2, update to version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. As a temporary workaround for users unable to upgrade, initialize implementation contracts using UUPSUpgradeable by invoking the initializer function, usually called initialize.

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2021-41264

GHSA-5VP3-V4HC-GX76

Affected Products

Openzeppelin Contracts

@Openzeppelin/Contracts-Upgradeable

References · 9

• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592 · Patch
• https://osv.dev/vulnerability/GHSA-5vp3-v4hc-gx76 · Vendor Advisory
• https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41264 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41264 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76 · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts · Note
• https://t.me/cibsecurity/32321 · Telegram Post
• https://t.me/cvenotify/23346 · Telegram Post