Summaryinfo

A vulnerability was found in OpenZeppelin Contracts up to 4.7.2 and classified as problematic. Impacted is the function ECDSA.recover/ECDSA.tryRecover of the component Signature Handler. Such manipulation leads to integrity check. This vulnerability is referenced as CVE-2022-35961. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in OpenZeppelin Contracts up to 4.7.2 and classified as problematic. Affected by this issue is the function ECDSA.recover/ECDSA.tryRecover of the component Signature Handler. The manipulation with an unknown input leads to a integrity check vulnerability. Using CWE to declare the problem leads to CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. Impacted is confidentiality, integrity, and availability. CVE summarizes:

OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single `bytes` argument, and not the functions that take `r, v, s` or `r, vs` as separate arguments. The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection. The issue has been patched in 4.7.3.

The weakness was published 08/15/2022 as GHSA-4h98-2769-gh6h. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2022-35961 since 07/15/2022. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 304110 (Linux Distros Unpatched Vulnerability : CVE-2026-33895), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.7.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be patching the affected component.

The vulnerability is also documented in the vulnerability database at Tenable (304110). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• OpenZeppelin

Name

• Contracts

Version

• 4.7.0
• 4.7.1
• 4.7.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion