CVE-2021-39168GHSA-VRW4-W73R-6MM8
TimelockController vulnerability in OpenZeppelin Contracts
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.3.1, 3.4.2, 3.4.2-solc-0.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
Timeline
- CVE published
- Record last updated
Affected versions
- OpenZeppelin openzeppelin-contracts-upgradeable
From 4.0.0 · fixed in 4.3.1; From 3.3.0 · fixed in 3.4.2; From 3.3.0-solc-0.7 · fixed in 3.4.2-solc-0.7
- @openzeppelin/contracts-upgradeablenpm
From 4.0.0 · fixed in 4.3.1
- @openzeppelin/contracts-upgradeablenpm
From 3.3.0 · fixed in 3.4.2