medium5.3
CVE-2022-35915
OpenZeppelin Contracts ERC165Checker unbounded gas consumption
Impact
### Impact The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. ### Patches The issue has been fixed in v4.7.2. ### References https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587 ### For more information If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @openzeppelin/contracts | >= 2.0.0, < 4.7.2 | 4.7.2 |
| npm | openzeppelin-solidity | >= 2.0.0, <= 4.6.0 | none recorded |
| npm | @openzeppelin/contracts-upgradeable | >= 3.2.0, < 4.7.2 | 4.7.2 |
| npm | openzeppelin-eth | >= 2.0.0, <= 2.2.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openzeppelin | Contracts | from 2.0.0 before 4.7.2 |
| Openzeppelin | Contracts Upgradeable | from 3.2.0 before 4.7.2 |
| Openzeppelin | Openzeppelin-Eth | from 2.0.0 |
| Openzeppelin | Openzeppelin-Solidity | from 2.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x
- https://github.com/advisories/GHSA-7grf-83vw-6f5x
- https://nvd.nist.gov/vuln/detail/CVE-2022-35915
- https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.2