CVE-2024-27094
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Résumé
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenZeppelin Contracts is a library for secure smart contract development. The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- patch github.com
- patch github.com