{"answers":{"affected":"3 open source packages ship an affected version, including openzeppelin-cairo-contracts. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31153 exists.","fix":"Upgrade openzeppelin-cairo-contracts to 0.2.1 or later.","what":"CVE-2022-31153 is a medium-severity vulnerability in OpenZeppelin cairo-contracts, published on 15 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-31153 and fix it if it is affected.\n\nWhat it is: CVE-2022-31153 is a medium-severity vulnerability in OpenZeppelin cairo-contracts, published on 15 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31153 exists.\n\nAffected packages and fixed versions:\n- openzeppelin-cairo-contracts (PyPI): affected all versions; fixed in 0.2.1\n- openzeppelin-cairo-contracts (PyPI): affected all versions; fixed in 0.2.1\n- openzeppelin-cairo-contracts (PyPI): affected all versions; fixed in 0.2.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-31153/ (Markdown: https://insights.sbomify.com/CVE-2022-31153/index.md)","id":"CVE-2022-31153","markdown":"https://insights.sbomify.com/CVE-2022-31153/index.md","name":"CVE-2022-31153","record":{"aliases":["GHSA-8mjr-jr5h-q2xr","PYSEC-2026-890"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Cairo smart contract library","requires_auth":"low_privilege","summary":"A logic error in OpenZeppelin Cairo contracts prevents account transactions on Goerli, causing denial of service for users.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"contracts","vendor":"openzeppelin"}],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-664","name":"Improper Control of a Resource Through its Lifetime"}],"description":"OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli","id":"CVE-2022-31153","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"business_logic","year":"2022"},"n_packages":3,"n_references":6,"next":{"headline":"Indirect Object Access in Sourcegraph Code Monitoring","id":"CVE-2022-31154"},"packages":[{"ecosystem":"PyPI","fixed":["0.2.1"],"introduced":["0"],"last_affected":[],"package":"openzeppelin-cairo-contracts","purl":null,"source":"GHSA-8mjr-jr5h-q2xr"},{"ecosystem":"PyPI","fixed":["0.2.1"],"introduced":["0"],"last_affected":[],"package":"openzeppelin-cairo-contracts","purl":"pkg:pypi/openzeppelin-cairo-contracts","source":"GHSA-8mjr-jr5h-q2xr"},{"ecosystem":"PyPI","fixed":["0.2.1"],"introduced":["0"],"last_affected":[],"package":"openzeppelin-cairo-contracts","purl":"pkg:pypi/openzeppelin-cairo-contracts","source":"PYSEC-2026-890"}],"prev":{"headline":"Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules","id":"CVE-2022-31152"},"products":["cairo-contracts"],"published":"2022-07-15","related":[{"cvss_score":10,"headline":"TimelockController vulnerability in OpenZeppelin Contracts","id":"CVE-2021-39167","kev_date_added":null,"published":"2021-08-26"},{"cvss_score":10,"headline":"TimelockController vulnerability in OpenZeppelin Contracts","id":"CVE-2021-39168","kev_date_added":null,"published":"2021-08-26"},{"cvss_score":9.8,"headline":"UUPSUpgradeable vulnerability in OpenZeppelin Contracts","id":"CVE-2021-41264","kev_date_added":null,"published":"2021-11-12"},{"cvss_score":7.9,"headline":"ECDSA signature malleability in OpenZeppelin Contracts","id":"CVE-2022-35961","kev_date_added":null,"published":"2022-08-14"},{"cvss_score":7.5,"headline":"GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts","id":"CVE-2022-31198","kev_date_added":null,"published":"2022-08-01"},{"cvss_score":7.5,"headline":"OpenZeppelin Contracts's ERC165Checker may revert instead of returning false","id":"CVE-2022-31170","kev_date_added":null,"published":"2022-07-21"},{"cvss_score":7.5,"headline":"OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers","id":"CVE-2022-31172","kev_date_added":null,"published":"2022-07-21"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-22","vendors":["OpenZeppelin"]},"summary":"A logic error in OpenZeppelin Cairo contracts prevents account transactions on Goerli, causing denial of service for users.","url":"https://insights.sbomify.com/CVE-2022-31153/"}