CVE-2024-27094
- Source
- https://cve.org/CVERecord?id=CVE-2024-27094
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27094.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-27094
- Aliases
- Published
- 2024-02-29T18:18:24Z
- Modified
- 2026-10-24T10:51:35Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
- Summary
- OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
- Details
-
OpenZeppelin Contracts is a library for secure smart contract development. The
Base64.encodefunction encodes abytesinput by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27094.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27094.json
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967
- https://nvd.nist.gov/vuln/detail/CVE-2024-27094
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c
Affected packages
Git / github.com/openzeppelin/openzeppelin-contracts
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openzeppelin/openzeppelin-contracts
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "4.5.0" }, { "fixed": "4.9.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "4.5.0" }, { "last_affected": "4.9.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "5.0.0" }, { "fixed": "5.0.2" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "5.0.0" }, { "fixed": "5.0.2" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "92224533b1263772b0774eec3134e132a3d7b2a6" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "a6286d0fded8771b3a645e5813e51993c490399c" } ], "source": "REFERENCES_COMMIT" } ] }
- Type
- GIT
- Repo
- https://github.com/openzeppelin/openzeppelin-contracts-upgradeable
- Events
-
IntroducedLast AffectedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "4.5.0" }, { "last_affected": "4.9.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "5.0.0" }, { "fixed": "5.0.2" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "2d081f24cac1a867f6f73d512f2022e1fa987854" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1" } ], "source": "REFERENCES_COMMIT" } ] }