CVE-2022-35915: Uncontrolled Resource Consumption

August 1, 2022 (updated July 21, 2023)

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

References

github.com/OpenZeppelin/openzeppelin-contracts/pull/3587
github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x
nvd.nist.gov/vuln/detail/CVE-2022-35915

Code Behaviors & Features

Detect and mitigate CVE-2022-35915 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →