CVE-2022-39384: OpenZeppelin Contracts initializer reentrancy may lead to double initialization
First published: Fri Nov 04 2022(Updated: )
OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible in the scenario described above, breaking the expectation that there is a single execution. Note that upgradeable proxies are commonly initialized together with contract creation, where reentrancy is not feasible, so the impact of this issue is believed to be minor. This issue has been patched, please upgrade to version 4.4.1. As a workaround, avoid untrusted external calls during initialization.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenZeppelin Contracts | >=3.2.0<4.4.1 | |
| OpenZeppelin Contracts Upgradeable | >=3.2.0<4.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-39384?
CVE-2022-39384 is a vulnerability in OpenZeppelin Contracts library versions before 4.4.1 and after 3.2.0 that allows reentrancy attacks in initializer functions invoked separately from contract creation.
How does CVE-2022-39384 impact OpenZeppelin Contracts?
CVE-2022-39384 impacts OpenZeppelin Contracts library by allowing reentrancy attacks in separate initializer functions invoked during contract creation.
What is the severity of CVE-2022-39384?
CVE-2022-39384 has a severity rating of medium, with a severity value of 5.6.
Which software versions are affected by CVE-2022-39384?
OpenZeppelin Contracts versions before 4.4.1 and after 3.2.0 are affected by CVE-2022-39384.
How can I fix CVE-2022-39384?
To fix CVE-2022-39384, update to OpenZeppelin Contracts version 4.4.1 or newer.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/openzeppelin
- canonical/openzeppelin contracts
- version/openzeppelin contracts/3.2.0
- canonical/openzeppelin contracts upgradeable
- version/openzeppelin contracts upgradeable/3.2.0