CVE-2023-30542

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-30542
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30542.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-30542
Aliases
Published
2023-04-16T07:10:13.474Z
Modified
2026-03-13T22:55:11.878389Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L CVSS Calculator
Summary
GovernorCompatibilityBravo may trim proposal calldata
Details

OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (propose) in GovernorCompatibilityBravo allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The ProposalCreated event correctly represents what will eventually execute, but the proposal parameters as queried through getActions appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length signatures and calldatas parameters.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30542.json"
}
References

Affected packages

Git
github.com/openzeppelin/openzeppelin-contracts

Affected ranges

Type
GIT
Repo
https://github.com/openzeppelin/openzeppelin-contracts
Events
Introduced
1d2e15fbd7314f4f60b47d97d9b852aacd5404f7
Fixed
0a25c1940ca220686588c4af3ec526f725fe2582

Affected versions

v4.*
v4.3.0
v4.3.1
v4.3.2
v4.4.0
v4.4.0-rc.0
v4.4.0-rc.1
v4.4.1
v4.8.0
v4.8.0-rc.0
v4.8.0-rc.1
v4.8.0-rc.2
v4.8.1
v4.8.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30542.json"
github.com/openzeppelin/openzeppelin-contracts-upgradeable

Affected ranges

Type
GIT
Repo
https://github.com/openzeppelin/openzeppelin-contracts-upgradeable
Events
Introduced
618d129b52c14aea8d37a413e4c8b643439abe73
Fixed
58fa0f81c4036f1a3b616fdffad2fd27e5d5ce21
Introduced
618d129b52c14aea8d37a413e4c8b643439abe73
Fixed
58fa0f81c4036f1a3b616fdffad2fd27e5d5ce21
Database specific 
{
    "versions": [
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.8.3"
        },
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.8.3"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30542.json"