Vulnerabilities > CVE-2023-34234 - Unspecified vulnerability in Openzeppelin Contracts and Contracts Upgradeable

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

LOW

network

low complexity

openzeppelin

NVD

Published: 2023-06-07

Updated: 2024-11-21

Summary

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.

Vulnerable Configurations

Part	Description	Count
Application	Openzeppelin Openzeppelin Contracts Upgradeable 4.3.0 Openzeppelin Contracts Upgradeable 4.3.1 Openzeppelin Contracts Upgradeable 4.3.2 Openzeppelin Contracts Upgradeable 4.3.3 Openzeppelin Contracts Upgradeable 4.4.0 Openzeppelin Contracts Upgradeable 4.4.1 Openzeppelin Contracts Upgradeable 4.4.2 Openzeppelin Contracts Upgradeable 4.5.0 Openzeppelin Contracts Upgradeable 4.5.1 Openzeppelin Contracts Upgradeable 4.5.2 Openzeppelin Contracts Upgradeable 4.6.0 Openzeppelin Contracts Upgradeable 4.7.0 Openzeppelin Contracts Upgradeable 4.7.1 Openzeppelin Contracts Upgradeable 4.7.2 Openzeppelin Contracts Upgradeable 4.7.3 Openzeppelin Contracts Upgradeable 4.8.0 Openzeppelin Contracts Upgradeable 4.8.1 Openzeppelin Contracts Upgradeable 4.8.2 Openzeppelin Contracts Upgradeable 4.8.3 Openzeppelin Contracts Upgradeable 4.9.0 Openzeppelin Contracts 4.3.0 Openzeppelin Contracts 4.3.1 Openzeppelin Contracts 4.3.2 Openzeppelin Contracts 4.3.3 Openzeppelin Contracts 4.4.0 Openzeppelin Contracts 4.4.1 Openzeppelin Contracts 4.4.2 Openzeppelin Contracts 4.5.0 Openzeppelin Contracts 4.6.0 Openzeppelin Contracts 4.7.0 Openzeppelin Contracts 4.7.1 Openzeppelin Contracts 4.7.2 Openzeppelin Contracts 4.7.3 Openzeppelin Contracts 4.8.0 Openzeppelin Contracts 4.8.1 Openzeppelin Contracts 4.8.2 Openzeppelin Contracts 4.8.3 Openzeppelin Contracts 4.9.0	56

Summary

Vulnerable Configurations

References