CVE-2023-40014: OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
First published: Thu Aug 10 2023(Updated: )
### Impact OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. ### Patches The problem has been patched in v4.9.3.
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/@openzeppelin/contracts-upgradeable | >=4.0.0<4.9.3 | 4.9.3 |
| npm/@openzeppelin/contracts | >=4.0.0<4.9.3 | 4.9.3 |
| OpenZeppelin Contracts | >=4.0.0<4.9.3 | |
| OpenZeppelin Contracts Upgradeable | >=4.0.0<4.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484
- https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp
- https://nvd.nist.gov/vuln/detail/CVE-2023-40014
- https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.3/CHANGELOG.md
- https://github.com/advisories/GHSA-g4vp-m682-qqmp (Advisory)
Frequently Asked Questions
What is CVE-2023-40014?
CVE-2023-40014 is a vulnerability in OpenZeppelin Contracts library versions 4.0.0 to 4.9.3 that may result in `_msgSender` returning `address(0)` in calls originating from a trusted forwarder.
How does the CVE-2023-40014 vulnerability impact OpenZeppelin Contracts?
The CVE-2023-40014 vulnerability impacts OpenZeppelin Contracts by causing the `_msgSender` function to return `address(0)` in calls originating from a trusted forwarder.
What is the severity of CVE-2023-40014?
The severity of CVE-2023-40014 is medium with a CVSS score of 5.3.
Which versions of OpenZeppelin Contracts are affected by CVE-2023-40014?
Versions 4.0.0 to 4.9.3 of OpenZeppelin Contracts are affected by CVE-2023-40014.
How can I fix the CVE-2023-40014 vulnerability?
To fix the CVE-2023-40014 vulnerability, update OpenZeppelin Contracts to version 4.9.3.
- collector/github-advisory-latest
- alias/GHSA-g4vp-m682-qqmp
- alias/CVE-2023-40014
- collector/github-advisory
- agent/type
- agent/remedy
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/nvd-index
- package-manager/npm
- vendor/openzeppelin
- canonical/openzeppelin contracts
- version/openzeppelin contracts/4.0.0
- canonical/openzeppelin contracts upgradeable
- version/openzeppelin contracts upgradeable/4.0.0