GHSA-7grf-83vw-6f5x

Suggest an improvement
Source
https://github.com/advisories/GHSA-7grf-83vw-6f5x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-7grf-83vw-6f5x/GHSA-7grf-83vw-6f5x.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7grf-83vw-6f5x
Aliases
Published
2022-08-14T00:23:34Z
Modified
2023-11-01T04:59:23.260340Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
OpenZeppelin Contracts ERC165Checker unbounded gas consumption
Details

Impact

The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.

Patches

The issue has been fixed in v4.7.2.

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587

For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at security@openzeppelin.com.

Database specific 
{
    "severity": "MODERATE",
    "github_reviewed_at": "2022-08-14T00:23:34Z",
    "github_reviewed": true,
    "nvd_published_at": "2022-08-01T21:15:00Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ]
}
References

Affected packages

npm / @openzeppelin/contracts

Package

Name
@openzeppelin/contracts
View open source insights on deps.dev
Purl
pkg:npm/%40openzeppelin/contracts

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0
Fixed
4.7.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-7grf-83vw-6f5x/GHSA-7grf-83vw-6f5x.json"

npm / openzeppelin-solidity

Package

Name
openzeppelin-solidity
View open source insights on deps.dev
Purl
pkg:npm/openzeppelin-solidity

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0
Last affected
4.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-7grf-83vw-6f5x/GHSA-7grf-83vw-6f5x.json"

npm / @openzeppelin/contracts-upgradeable

Package

Name
@openzeppelin/contracts-upgradeable
View open source insights on deps.dev
Purl
pkg:npm/%40openzeppelin/contracts-upgradeable

Affected ranges

Type
SEMVER
Events
Introduced
3.2.0
Fixed
4.7.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-7grf-83vw-6f5x/GHSA-7grf-83vw-6f5x.json"

npm / openzeppelin-eth

Package

Name
openzeppelin-eth
View open source insights on deps.dev
Purl
pkg:npm/openzeppelin-eth

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0
Last affected
2.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-7grf-83vw-6f5x/GHSA-7grf-83vw-6f5x.json"