Vulnerability Details : CVE-2023-40014
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.
Products affected by CVE-2023-40014
- Openzeppelin » Openzeppelin Contracts » For Node.jsVersions from including (>=) 4.0.0 and before (<) 4.9.3cpe:2.3:a:openzeppelin:openzeppelin_contracts:*:*:*:*:*:node.js:*:*
- Openzeppelin » Openzeppelin Contracts-upgradable » For Node.jsVersions from including (>=) 4.0.0 and before (<) 4.9.3cpe:2.3:a:openzeppelin:openzeppelin_contracts-upgradable:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-40014
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-40014
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST | |
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2023-40014
-
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.Assigned by: security-advisories@github.com (Primary)
References for CVE-2023-40014
-
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp
ERC2771Context with custom forwarder may lead to zero-valued _msgSender · Advisory · OpenZeppelin/openzeppelin-contracts · GitHubVendor Advisory
-
https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3
Release v4.9.3 · OpenZeppelin/openzeppelin-contracts · GitHubRelease Notes
-
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd
Adjust ERC2771Context._msgData for msg.data.length < 20 (#4484) · OpenZeppelin/openzeppelin-contracts@9445f96 · GitHubPatch
-
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5
Adjust ERC2771Context._msgData for msg.data.length < 20 (#4484) · OpenZeppelin/openzeppelin-contracts@e4435ee · GitHubPatch
-
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484
Adjust ERC2771Context._msgData for msg.data.length < 20 by frangio · Pull Request #4484 · OpenZeppelin/openzeppelin-contracts · GitHubPatch;Vendor Advisory
-
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481
Make ERC2771Context return original sender address if `msg.data.length <= 20` by ernestognw · Pull Request #4481 · OpenZeppelin/openzeppelin-contracts · GitHubPatch;Vendor Advisory
Jump to