PT-2022-23021 · Openzeppelin · Openzeppelin Contracts

Frangio · Published 2022-08-01 · Updated 2023-07-21 · CVE-2022-35915

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions prior to 4.7.2

Description The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.

Recommendations For versions prior to 4.7.2, upgrade to version 4.7.2 to resolve the issue. As a temporary workaround, consider restricting the amount of data returned by the target contract of an EIP-165 supportsInterface query to prevent unbounded gas consumption.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2022-35915

GHSA-7GRF-83VW-6F5X

Affected Products

Openzeppelin Contracts

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35915.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587 · Patch
• https://osv.dev/vulnerability/GHSA-7grf-83vw-6f5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35915 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35915 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.2 · Note
• https://t.me/cibsecurity/47387 · Telegram Post