CVE-2022-31172

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. The issue was patched in version 4.7.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-347

Affected software

Vendor	Product	Versions
OpenZeppelin	openzeppelin-contracts	>= 4.1.0, < 4.7.1

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552Patch, Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552Patch, Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9Third Party Advisory

Timeline

Published: Jul 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-311737.5Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program c CVE-2022-311754.7CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's CVE-2022-311768.1Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/CVE-2022-311772.7Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated CVE-2022-311784.3eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a tem CVE-2022-311799.8Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. Thi CVE-2022-31189.8A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing of CVE-2022-311809.8Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when int CVE-2022-311819.8PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vul CVE-2022-311825.3Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error CVE-2022-311839.8fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the paramete CVE-2022-311847.5Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails.