CVE-2021-41264

描述

### Impact Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. ### Patches A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. ### Workarounds Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301). ### References [Post-mortem](https://forum.openzeppelin.com/t/uupsupgradeable-vulnerability-post-mortem/15680). ### For more information If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.

如何修補 CVE-2021-41264

要修補 CVE-2021-41264,請將受影響套件升級到下列已修補版本。

• —升級至 4.3.2 或更新版本
• —升級至 4.3.2 或更新版本

CVE-2021-41264 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 4.1.0, < 4.3.2
• >= 4.1.0, < 4.3.2

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-41264
• PATCHgithub.com/OpenZeppelin/openzeppelin-contracts
• WEBforum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301
• WEBgithub.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592