CVE-2022-35961 affects OpenZeppelin Contracts, specifically the ECDSA.recover and ECDSA.tryRecover functions, due to signature malleability when accepting EIP-2098 compact signatures. This medium severity vulnerability (CVSS 6.5) allows an authenticated attacker to bypass signature reuse or replay protection by resubmitting a previously used signature in a different format, leading to high integrity impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.1.0, < 4.7.3CPE matchmatch criteria | cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:* | ||
>= 4.1.0, < 4.7.3CPE matchmatch criteria | cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.