{"answers":{"affected":"4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 2 products.","exploited":"There is no known exploitation of CVE-2023-40014 in the wild and no public exploit code.","fix":"Upgrade @openzeppelin/contracts to 4.9.3 or later.","what":"CVE-2023-40014 is a medium-severity vulnerability in openzeppelin-contracts, published on 10 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-40014 and fix it if it is affected.\n\nWhat it is: CVE-2023-40014 is a medium-severity vulnerability in openzeppelin-contracts, published on 10 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-40014 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @openzeppelin/contracts (npm): affected from 4.0.0; fixed in 4.9.3\n- @openzeppelin/contracts (npm): affected from 4.0.0; fixed in 4.9.3\n- @openzeppelin/contracts-upgradeable (npm): affected from 4.0.0; fixed in 4.9.3\n- @openzeppelin/contracts-upgradeable (npm): affected from 4.0.0; fixed in 4.9.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-40014/ (Markdown: https://insights.sbomify.com/CVE-2023-40014/index.md)","id":"CVE-2023-40014","markdown":"https://insights.sbomify.com/CVE-2023-40014/index.md","name":"CVE-2023-40014","record":{"aliases":["GHSA-g4vp-m682-qqmp","UBUNTU-CVE-2023-40014"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Smart contract library","requires_auth":"none","summary":"Attackers can bypass sender verification in smart contracts using custom forwarders, potentially leading to unauthorized actions.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"openzeppelin_contracts","vendor":"openzeppelin"},{"product":"openzeppelin_contracts-upgradable","vendor":"openzeppelin"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"}],"description":"OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender","id":"CVE-2023-40014","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"business_logic","year":"2023"},"n_packages":4,"n_references":6,"next":{"headline":"Vyper: reversed order of side effects for some operations","id":"CVE-2023-40015"},"packages":[{"ecosystem":"npm","fixed":["4.9.3"],"introduced":["4.0.0"],"last_affected":[],"package":"@openzeppelin/contracts","purl":null,"source":"GHSA-g4vp-m682-qqmp"},{"ecosystem":"npm","fixed":["4.9.3"],"introduced":["4.0.0"],"last_affected":[],"package":"@openzeppelin/contracts","purl":"pkg:npm/%40openzeppelin/contracts","source":"GHSA-g4vp-m682-qqmp"},{"ecosystem":"npm","fixed":["4.9.3"],"introduced":["4.0.0"],"last_affected":[],"package":"@openzeppelin/contracts-upgradeable","purl":null,"source":"GHSA-g4vp-m682-qqmp"},{"ecosystem":"npm","fixed":["4.9.3"],"introduced":["4.0.0"],"last_affected":[],"package":"@openzeppelin/contracts-upgradeable","purl":"pkg:npm/%40openzeppelin/contracts-upgradeable","source":"GHSA-g4vp-m682-qqmp"}],"prev":{"headline":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in external-svg-loader","id":"CVE-2023-40013"},"products":["openzeppelin-contracts"],"published":"2023-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-10-03","vendors":["OpenZeppelin"]},"summary":"Attackers can bypass sender verification in smart contracts using custom forwarders, potentially leading to unauthorized actions.","url":"https://insights.sbomify.com/CVE-2023-40014/"}