CVE-2024-27094
published 2024-03-21CVE-2024-27094: OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks…
PriorityP340high7.4CVSS 3.1
AVNACHPRNUINSUCHINAH
EPSS
0.76%
51.2th percentile
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openzeppelin | contracts | >= 4.5.0 < 4.9.6 | 4.9.6 |
| openzeppelin | contracts | >= 4.5.0 < 4.9.6 | 4.9.6 |
| openzeppelin | contracts | >= 5.0.0 < 5.0.2 | 5.0.2 |
| openzeppelin | contracts | >= 5.0.0-rc.0 < 5.0.2 | 5.0.2 |
| openzeppelin | contracts-upgradeable | >= 4.5.0 < 4.9.6 | 4.9.6 |
| openzeppelin | contracts-upgradeable | >= 5.0.0-rc.0 < 5.0.2 | 5.0.2 |
| openzeppelin | contracts_upgradeable | 4.5.0 – 4.9.6 | — |
| openzeppelin | contracts_upgradeable | >= 5.0.0 < 5.0.2 | 5.0.2 |
| openzeppelin | openzeppelin-contracts | — | — |
| openzeppelin | openzeppelin-contracts | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
osv·2024-02-29
CVE-2024-27094 [MEDIUM] OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
### Impact
The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer.
Although the `encode` function pads the output for these cases, up to 4 bits of data are kept between the encoding and padding, corrupting the output if these bits were dirty (i.e. memory after the input is not 0). These conditions are more frequent in the following scenarios:
- A `bytes memory` struct is allocated just after the input and the first bytes of it are non-zero.
- The memory pointer is set to a non-empty memory location before allocating the input.
Developers should eval
GHSA
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
ghsa·2024-02-29
CVE-2024-27094 [MEDIUM] CWE-125 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
### Impact
The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer.
Although the `encode` function pads the output for these cases, up to 4 bits of data are kept between the encoding and padding, corrupting the output if these bits were dirty (i.e. memory after the input is not 0). These conditions are more frequent in the following scenarios:
- A `bytes memory` struct is allocated just after the input and the first bytes of it are non-zero.
- The memory pointer is set to a non-empty memory location before allocating the input.
Developers should eval
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399chttps://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399chttps://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967
2024-03-21
Published