CVE-2022-35915

描述

### Impact The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. ### Patches The issue has been fixed in v4.7.2. ### References https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587 ### For more information If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [[email protected]](mailto:[email protected]).

受影響套件(4)

• npm/@openzeppelin/contracts>= 2.0.0, < 4.7.2
• npm/@openzeppelin/contracts-upgradeable>= 3.2.0, < 4.7.2
• npm/openzeppelin-eth>= 2.0.0, <= 2.2.0
• npm/openzeppelin-solidity>= 2.0.0, <= 4.6.0

CVSS 分數

參考連結(5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-35915
• PATCHhttps://github.com/OpenZeppelin/openzeppelin-contracts
• WEBhttps://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587
• WEBhttps://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.2
• WEBhttps://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x