CVE-2022-35961 Explained : Impact and Mitigation

OpenZeppelin Contracts library versions >= 4.1.0 and < 4.7.3 are vulnerable to an ECDSA signature malleability issue that can impact the integrity and confidentiality of affected systems. Learn more about CVE-2022-35961 below.

Understanding CVE-2022-35961

This section provides insights into the nature of the vulnerability present in OpenZeppelin Contracts.

What is CVE-2022-35961?

OpenZeppelin Contracts is susceptible to a signature malleability flaw in the functions

ECDSA.recover

and

ECDSA.tryRecover

. The vulnerability arises from the acceptance of EIP-2098 compact signatures alongside the standard 65 byte signature format. Systems using vulnerable functions with a single

bytes

argument are at risk.

The Impact of CVE-2022-35961

The vulnerability poses a high severity risk with a CVSS base score of 7.9 due to its potential for high confidentiality and integrity impact. The attack complexity is high, requiring low privileges and user interaction over a network.

Technical Details of CVE-2022-35961

Explore the specific technical aspects related to CVE-2022-35961 below.

Vulnerability Description

The flaw allows for signature reuse or replay protection bypass by manipulating and resubmitting signatures in a different format, impacting systems implementing improper protective measures.

Affected Systems and Versions

OpenZeppelin Contracts versions >= 4.1.0 and < 4.7.3 are vulnerable to this signature malleability issue.

Exploitation Mechanism

The exploitation requires network access and low privileges, with user interaction needed for successful attacks.

Mitigation and Prevention

Discover the necessary steps to protect systems from the CVE-2022-35961 vulnerability.

Immediate Steps to Take

Update to version 4.7.3 of OpenZeppelin Contracts to patch the vulnerability and enhance system security.

Long-Term Security Practices

Implement secure coding practices and regularly update libraries to prevent similar vulnerabilities in the future.

Patching and Updates

Refer to the provided GitHub links for detailed information on the vulnerability and the patch implemented in version 4.7.3 of OpenZeppelin Contracts.