Vulnerability Description
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openzeppelin | Contracts | >= 4.5.0, < 4.9.6 |
| Openzeppelin | Contracts Upgradeable | >= 4.5.0, <= 4.9.6 |
Related Weaknesses (CWE)
References
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081fPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0Patch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3aPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-Vendor Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081fPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0Patch
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3aPatch
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-Vendor Advisory
FAQ
What is CVE-2024-27094?
CVE-2024-27094 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a mult...
How severe is CVE-2024-27094?
CVE-2024-27094 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-27094?
Check the references section above for vendor advisories and patch information. Affected products include: Openzeppelin Contracts, Openzeppelin Contracts Upgradeable.