OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and     prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see     `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20     bytes. This combination of circumstances does not appear to be common, in particular it is not the case     for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given     that the signer address is appended to all calls that originate from these forwarders. The problem has     been patched in v4.9.3. (CVE-2023-40014)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and
    prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see
    `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20
    bytes. This combination of circumstances does not appear to be common, in particular it is not the case
    for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given
    that the signer address is appended to all calls that originate from these forwarders. The problem has
    been patched in v4.9.3. (CVE-2023-40014)

ID	Name	Product	Family	Severity
262074	Linux Distros Unpatched Vulnerability : CVE-2023-40014	Nessus	Misc.	medium
414872	SCA: security update for @openzeppelin/contracts, @openzeppelin/contracts-upgradeable (GHSA-g4vp-m682-qqmp)	Tenable Cloud Security	SCA Checks	medium
414872	SCA: security update for @openzeppelin/contracts, @openzeppelin/contracts-upgradeable (GHSA-g4vp-m682-qqmp)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-40014

medium

Tenable Plugins

medium

medium

medium