CVE:CVE-2023-30543
CNNVD:CNNVD-202304-1389
web3-react是用于构建现代以太坊 dApp 的简单、最大可扩展、依赖最小化的框架。
web3-react存在竞争条件问题漏洞，该漏洞源于如果用户在连接流程中更改链，则从chainId派生的任何数据都可能不正确。
solution:Upgrade uniswap web3-react_coinbase-wallet to a higher version than 6.2.14,7.0.0:alpha0,7.0.1:alpha0,7.0.2:alpha0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,8.0.27:beta0,8.0.28:beta0,8.0.29:beta0,8.0.30:beta0,8.0.31:beta0,8.0.32:beta0,8.0.33:beta0,8.0.34:beta0,and avoid the version [6.0.0,6.2.14],7.0.0:alpha0,7.0.1:alpha0,7.0.2:alpha0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,8.0.27:beta0,8.0.28:beta0,8.0.29:beta0,8.0.30:beta0,8.0.31:beta0,8.0.32:beta0,8.0.33:beta0,8.0.34:beta0; Upgrade uniswap web3-react_eip1193 to a higher version than 6.2.14,7.0.0:alpha0,7.0.1:alpha0,7.0.2:alpha0,8.0.0:beta0,8.0.1:beta0,8.0.2:beta0,8.0.3:beta0,8.0.4:beta0,8.0.5:beta0,8.0.6:beta0,8.0.7:beta0,8.0.8:beta0,8.0.9:beta0,8.0.10:beta0,8.0.11:beta0,8.0.12:beta0,8.0.13:beta0,8.0.14:beta0,8.0.15:beta0,8.0.16:beta0,8.0.17:beta0,8.0.18:beta0,8.0.19:beta0,8.0.20:beta0,8.0.21:beta0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,and avoid the version [6.0.0,6.2.14],7.0.0:alpha0,7.0.1:alpha0,7.0.2:alpha0,8.0.0:beta0,8.0.1:beta0,8.0.2:beta0,8.0.3:beta0,8.0.4:beta0,8.0.5:beta0,8.0.6:beta0,8.0.7:beta0,8.0.8:beta0,8.0.9:beta0,8.0.10:beta0,8.0.11:beta0,8.0.12:beta0,8.0.13:beta0,8.0.14:beta0,8.0.15:beta0,8.0.16:beta0,8.0.17:beta0,8.0.18:beta0,8.0.19:beta0,8.0.20:beta0,8.0.21:beta0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0; Upgrade uniswap web3-react_metamask to a higher version than 6.2.14,8.0.0:beta0,8.0.1:beta0,8.0.2:beta0,8.0.3:beta0,8.0.4:beta0,8.0.5:beta0,8.0.6:beta0,8.0.7:beta0,8.0.8:beta0,8.0.9:beta0,8.0.10:beta0,8.0.11:beta0,8.0.12:beta0,8.0.13:beta0,8.0.14:beta0,8.0.15:beta0,8.0.16:beta0,8.0.17:beta0,8.0.18:beta0,8.0.19:beta0,8.0.20:beta0,8.0.21:beta0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,8.0.27:beta0,8.0.28:beta0,8.0.29:beta0,and avoid the version [6.0.0,6.2.14],8.0.0:beta0,8.0.1:beta0,8.0.2:beta0,8.0.3:beta0,8.0.4:beta0,8.0.5:beta0,8.0.6:beta0,8.0.7:beta0,8.0.8:beta0,8.0.9:beta0,8.0.10:beta0,8.0.11:beta0,8.0.12:beta0,8.0.13:beta0,8.0.14:beta0,8.0.15:beta0,8.0.16:beta0,8.0.17:beta0,8.0.18:beta0,8.0.19:beta0,8.0.20:beta0,8.0.21:beta0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,8.0.27:beta0,8.0.28:beta0,8.0.29:beta0; Upgrade uniswap web3-react_walletconnect to a higher version than 6.2.14,7.0.0:alpha0,7.0.1:alpha0,7.0.2:alpha0,8.0.0:beta0,8.0.1:beta0,8.0.2:beta0,8.0.3:beta0,8.0.4:beta0,8.0.5:beta0,8.0.6:beta0,8.0.7:beta0,8.0.8:beta0,8.0.9:beta0,8.0.10:beta0,8.0.11:beta0,8.0.12:beta0,8.0.13:beta0,8.0.14:beta0,8.0.15:beta0,8.0.16:beta0,8.0.17:beta0,8.0.18:beta0,8.0.19:beta0,8.0.20:beta0,8.0.21:beta0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,8.0.27:beta0,8.0.28:beta0,8.0.29:beta0,8.0.30:beta0,8.0.31:beta0,8.0.32:beta0,8.0.33:beta0,8.0.34:beta0,8.0.35:beta0,8.0.36:beta0,and avoid the version [6.0.0,6.2.14],7.0.0:alpha0,7.0.1:alpha0,7.0.2:alpha0,8.0.0:beta0,8.0.1:beta0,8.0.2:beta0,8.0.3:beta0,8.0.4:beta0,8.0.5:beta0,8.0.6:beta0,8.0.7:beta0,8.0.8:beta0,8.0.9:beta0,8.0.10:beta0,8.0.11:beta0,8.0.12:beta0,8.0.13:beta0,8.0.14:beta0,8.0.15:beta0,8.0.16:beta0,8.0.17:beta0,8.0.18:beta0,8.0.19:beta0,8.0.20:beta0,8.0.21:beta0,8.0.22:beta0,8.0.23:beta0,8.0.24:beta0,8.0.25:beta0,8.0.26:beta0,8.0.27:beta0,8.0.28:beta0,8.0.29:beta0,8.0.30:beta0,8.0.31:beta0,8.0.32:beta0,8.0.33:beta0,8.0.34:beta0,8.0.35:beta0,8.0.36:beta0