Vulnerability Description
OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openzeppelin | Contracts | >= 4.1.0, < 4.3.2 |
Related Weaknesses (CWE)
References
- https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementatioIssue TrackingMitigationPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f7PatchThird Party Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-Third Party Advisory
- https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementatioIssue TrackingMitigationPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f7PatchThird Party Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-Third Party Advisory
FAQ
What is CVE-2021-41264?
CVE-2021-41264 is a vulnerability with a CVSS score of 9.8 (CRITICAL). OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementa...
How severe is CVE-2021-41264?
CVE-2021-41264 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-41264?
Check the references section above for vendor advisories and patch information. Affected products include: Openzeppelin Contracts.