Description
OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata. The probability of an accidental clash is negligible, but one could be caused deliberately and could cause a reduction in availability. The issue has been fixed in version 4.8.3. As a workaround if a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.
Remediation
References
https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-mx2q-35m2-x2rh
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154
Related Vulnerabilities
CVE-2019-17195 Vulnerability in maven package com.nimbusds:nimbus-jose-jwt
CVE-2023-33187 Vulnerability in npm package highlight.run
CVE-2023-32070 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-xml
CVE-2021-46366 Vulnerability in maven package info.magnolia:magnolia-core
CVE-2023-32977 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-job