GHSA-m6w8-fq7v-ph4m: @openzeppelin/contracts GovernorCompatibilityBravo Incorrect ABI Encoding May Vulnerability
MODERATEGHSA-m6w8-fq7v-ph4m is a MODERATE governorcompatibilitybravo incorrect abi encoding may vulnerability (General Security Weakness) affecting @openzeppelin/contracts libraries in the npm ecosystem. The issue involves governorcompatibilitybravo incorrect abi encoding may lead to unexpected behavior. Remediation is available by upgrading affected packages to version 4.4.2.
GHSA-m6w8-fq7v-ph4m at a Glance
How to Fix GHSA-m6w8-fq7v-ph4m
To remediate this vulnerability, upgrade all affected @openzeppelin/contracts dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @openzeppelin/contracts@4.4.2npm install @openzeppelin/contracts-upgradeable@4.4.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @openzeppelin/contractsHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-m6w8-fq7v-ph4m, inspect your project dependencies using npm:
npm ls @openzeppelin/contractsAnalyze the terminal output to locate any version of @openzeppelin/contracts in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.4.2), your application is affected.
Note: The npm ls @openzeppelin/contracts command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In @openzeppelin/contracts, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-m6w8-fq7v-ph4m Affected @openzeppelin/contracts Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@openzeppelin/contracts
|
npm |
≥ 4.3.0
< 4.4.2
|
4.4.2
|
|
@openzeppelin/contracts-upgradeable
|
npm |
≥ 4.3.0
< 4.4.2
|
4.4.2
|
References
Frequently Asked Questions
What is GHSA-m6w8-fq7v-ph4m?
Which @openzeppelin/contracts versions are affected?
What version fixes GHSA-m6w8-fq7v-ph4m?
Is @openzeppelin/contracts affected?
Is @openzeppelin/contracts-upgradeable affected?
What CWE is associated with GHSA-m6w8-fq7v-ph4m?
How can I check npm dependencies for GHSA-m6w8-fq7v-ph4m?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m6w8-fq7v-ph4m",
"modified" : "2022-01-12T21:38:27Z",
"published" : "2022-01-13T16:09:36Z",
"aliases" : [ ],
"summary" : "GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior",
"details" : "### Impact\n\nThe `GovernorCompatibilityBravo` module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function `foo(uint256)` is created as `propose([target], [0], [\"foo(uint256)\"], [\"0x00..01\"])`. If the function selector is provided as part of the encoded proposal data the issue is not present, e.g. the same proposal is created as `propose([target], [0], [\"0x2fbebd3800..01\"])`, where `2fbebd38` is the function selector.\n\nWe've assessed the instances of this contract found on chain, and did not find any occurrence of this bug in the past. Proposal creation through Tally or OpenZeppelin Defender is not affected. The core `Governor` contract on its own is not affected.\n\n### Patches\n\nA fix is included in version v4.4.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\n\nDo not create proposals using explicit function signatures. Instead, use the `propose` function without the `signatures` argument, and create the proposal using the fully ABI-encoded function call including the function selector in the `calldatas` argument as explained above.\n\n### References\n\nhttps://github.com/OpenZeppelin/openzeppelin-contracts/issues/3099\n\n### Credits\n\nThis issue was identified and reported by @GeraldHost.\n\n### For more information\n\nIf you have any questions, comments, or need assistance regarding this advisory, email us at security@openzeppelin.com.\n\nTo submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@openzeppelin/contracts"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.3.0"
}, {
"fixed" : "4.4.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@openzeppelin/contracts-upgradeable"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.3.0"
}, {
"fixed" : "4.4.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-m6w8-fq7v-ph4m"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2022-01-11T23:50:55Z",
"nvd_published_at" : null
}
}