Is CVE-2023-49798 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-49798 being exploited in the wild.

How severe is CVE-2023-49798?

Low severity, with a CVSS score of 3.1, published 12 December 2023.

Which products and versions are affected?

@openzeppelin/contracts (npm) SEMVER:introduced=4.9.4,fixed=4.9.5; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.9.4,fixed=4.9.5; OpenZeppelin Contracts 4.9.4; OpenZeppelin Contracts Upgradeable 4.9.4.

Is there a fix for CVE-2023-49798?

Yes. @openzeppelin/contracts (npm): upgrade to 4.9.5 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-49798 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-49798?

Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-49798: OpenZeppelin Contracts duplicated execution in Multicall

CVE-2023-49798 · Severity: low · CVSS 3.1 · Published 2023-12-12

OpenZeppelin Contracts is a library providing secure, reusable smart contract components used by blockchain developers. Version 4.9.4 contains a merge conflict bug in the Multicall feature that causes subcalls to execute twice, potentially leading to duplicate asset transfers and unintended financial transactions.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2023-49798 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-49798 being exploited in the wild.
How severe is CVE-2023-49798?: Low severity, with a CVSS score of 3.1, published 12 December 2023.
Which products and versions are affected?: @openzeppelin/contracts (npm) SEMVER:introduced=4.9.4,fixed=4.9.5; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.9.4,fixed=4.9.5; OpenZeppelin Contracts 4.9.4; OpenZeppelin Contracts Upgradeable 4.9.4.
Is there a fix for CVE-2023-49798?: Yes. @openzeppelin/contracts (npm): upgrade to 4.9.5 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-49798 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-49798?: Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openzeppelin/contracts (npm): upgrade to 4.9.5 or later
```
npm install @openzeppelin/contracts@4.9.5
```
@openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.5 or later
```
npm install @openzeppelin/contracts-upgradeable@4.9.5
```

Technical details

A merge conflict during porting of the Multicall update from v5.0.1 to the v4.9 branch resulted in a duplicated delegatecall instruction. Versions 4.9.4 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable are affected. When Multicall is used, each subcall is executed twice instead of once, enabling unintentional duplicate operations such as asset transfers. The vulnerability is a code-level logic error (CWE-670) that does not require authentication or special network preconditions. It was patched in version 4.9.5, and version 4.9.4 has been marked as deprecated.

Affected products

OpenZeppelin Contracts 4.9.4
OpenZeppelin Contracts Upgradeable 4.9.4

Identifiers

CVE-2023-49798
GHSA-699g-q6qh-q4v8

Timeline

2023-12-08: disclosed
2023-12-12: patched: Fixed in version 4.9.5

References

https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-699g-q6qh-q4v8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.