GHSA-4h98-2769-gh6h

Suggest an improvement
Source
https://github.com/advisories/GHSA-4h98-2769-gh6h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-4h98-2769-gh6h/GHSA-4h98-2769-gh6h.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-4h98-2769-gh6h
Aliases
Published
2022-08-18T19:00:43Z
Modified
2023-11-01T04:59:25.279537Z
Severity
  • 7.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
Details

Impact

The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single bytes argument, and not the functions that take r, v, s or r, vs as separate arguments.

The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection.

Patches

The issue has been patched in 4.7.3.

For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at security@openzeppelin.com.

Database specific 
{
    "nvd_published_at": "2022-08-15T11:21:00Z",
    "github_reviewed_at": "2022-08-18T19:00:43Z",
    "cwe_ids": [
        "CWE-354"
    ],
    "github_reviewed": true,
    "severity": "HIGH"
}
References

Affected packages

npm / @openzeppelin/contracts

Package

Name
@openzeppelin/contracts
View open source insights on deps.dev
Purl
pkg:npm/%40openzeppelin/contracts

Affected ranges

Type
SEMVER
Events
Introduced
4.1.0
Fixed
4.7.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-4h98-2769-gh6h/GHSA-4h98-2769-gh6h.json"

npm / @openzeppelin/contracts-upgradeable

Package

Name
@openzeppelin/contracts-upgradeable
View open source insights on deps.dev
Purl
pkg:npm/%40openzeppelin/contracts-upgradeable

Affected ranges

Type
SEMVER
Events
Introduced
4.1.0
Fixed
4.7.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-4h98-2769-gh6h/GHSA-4h98-2769-gh6h.json"