npm/@openzeppelin/contracts CVE-2023-30542: high 8.8, EPSS 0.58%

GovernorCompatibilityBravo may trim proposal calldata

Action: Upgrade @openzeppelin/contracts to 4.8.3 or later.

npm i @openzeppelin/contracts@4.8.3

Affected

Fixed versions

Sources

• osv: GHSA-93hq-5wgc-jc82
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82
• https://nvd.nist.gov/vuln/detail/CVE-2023-30542
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/8d633cb7d169f2f8595b273660b00b69e845c2fe
• https://github.com/OpenZeppelin/openzeppelin-contracts
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3

CVE-2023-30542 · published 2023-04-20T14:11:03Z · modified 2023-11-08T04:12:24.945774Z · JSON