CVE-2024-27094
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
概要
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OpenZeppelin Contracts is a library for secure smart contract development. The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- patch github.com
- patch github.com