CVE-2024-27094 – OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

https://notcve.org/view.php?id=CVE-2024-27094

29 Feb 2024 — OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6. OpenZeppelin Contracts es una librería para el desarrollo seguro de contratos inteligentes. • https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854 • CWE-125: Out-of-bounds Read •