OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4

高 7.5CVE-2023-49798 · GHSA-699g-q6qh-q4v8 · 09/12/2023 公開 · 17/06/2026 更新

要点

CVE-2023-49798 は contracts (openzeppelin), contracts upgradeable (openzeppelin), @openzeppelin/contracts に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.54%（全脆弱性の 45.7% より高い）。
対処：4.9.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
contracts openzeppelin	`= 4.9.4`	修正版なし
contracts upgradeable openzeppelin	`= 4.9.4`	修正版なし
@openzeppelin/contracts npm	`≥ 4.9.4, < 4.9.5`	`4.9.5`
@openzeppelin/contracts-upgradeable npm	`≥ 4.9.4, < 4.9.5`	`4.9.5`

概要

Context

Merge conflict resolution issue when porting the v5.0.1 Multicall update to the v4.9 branch caused a duplicated line.

Impact

Versions using Multicall from @openzeppelin/[email protected] and @openzeppelin/[email protected] will execute each subcall twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers.

Patches

The duplicated delegatecall was removed in 4.9.5. The 4.9.4 version is marked as deprecated.

NVD の説明

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/[email protected]` and `@openzeppelin/[email protected]`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.