CVE-2022-31153

原作者: [db:作者] 来自: [db:来源] 收藏邀请

Current Description

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.

View Analysis Description

Severity

CVSS 3.x Severity and Metrics:

CNA: GitHub, Inc.

Base Score: 6.5 MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: The NVD and the CNA have provided the same score. When this occurs only the CNA information is displayed, but the Acceptance Level icon for the CNA is given a checkmark to signify NVD concurrence.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Hyperlink	Resource
https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203	Exploit Third Party Advisory
https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9	Patch Third Party Advisory
https://github.com/OpenZeppelin/cairo-contracts/issues/386	Exploit Issue Tracking Third Party Advisory
https://github.com/OpenZeppelin/cairo-contracts/pull/387	Patch Third Party Advisory
https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1	Release Notes Third Party Advisory
https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	NIST
CWE-664	Improper Control of a Resource Through its Lifetime	GitHub, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

1 change records found show changes

Initial Analysis 7/22/2022 12:38:26 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:a:openzeppelin:contracts:0.2.0:::::cairo::*
Added	CVSS V3.1		NIST AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST CWE-863
Changed	Reference Type	https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203 No Types Assigned	https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203 Exploit, Third Party Advisory
Changed	Reference Type	https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 No Types Assigned	https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 Patch, Third Party Advisory
Changed	Reference Type	https://github.com/OpenZeppelin/cairo-contracts/issues/386 No Types Assigned	https://github.com/OpenZeppelin/cairo-contracts/issues/386 Exploit, Issue Tracking, Third Party Advisory
Changed	Reference Type	https://github.com/OpenZeppelin/cairo-contracts/pull/387 No Types Assigned	https://github.com/OpenZeppelin/cairo-contracts/pull/387 Patch, Third Party Advisory
Changed	Reference Type	https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1 No Types Assigned	https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1 Release Notes, Third Party Advisory
Changed	Reference Type	https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr No Types Assigned	https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr Third Party Advisory

鲜花

握手

雷人

路过

鸡蛋

该文章已有0人参与评论

请发表评论

全部评论

专题导读

More+

09-23 CVE-2020-36276

09-18 CVE-2022-36676

09-18 CVE-2022-36674

09-18 CVE-2022-36672

09-18 CVE-2022-36671

09-18 CVE-2022-36675

09-18 CVE-2022-36449

09-18 CVE-2022-36130

09-18 CVE-2022-37130

09-18 CVE-2022-37129

09-18 CVE-2022-37123

09-18 CVE-2022-36619

09-18 CVE-2022-37125

09-18 CVE-2022-36051

09-18 CVE-2022-36620

09-18 CVE-2022-36203

09-18 CVE-2022-36202

09-18 CVE-2022-36201

09-18 CVE-2022-2898

09-18 CVE-2022-2897

09-18 CVE-2022-2896

09-18 CVE-2022-2894

09-18 CVE-2022-2895

09-18 CVE-2022-2892

09-18 CVE-2022-36582

09-18 CVE-2022-36581

09-18 CVE-2022-36580

09-18 CVE-2022-36571

09-18 CVE-2022-36570

09-18 CVE-2022-36569

CVE-2022-31157发布时间：2022-07-29

CVE-2022-34252发布时间：2022-07-29

剪的笔顺,诠释剪的笔画,认识剪的部首

1 六六分期app的软件客服如何联系？(六六分期

六六分期app的软件客服如何联系？不知道吗？加qq群【895510560】即可！标题：六六分期

阅读：9150|2023-10-27

2 可心卡盟:win10系统火狐flash插件崩溃怎么

今天小编告诉大家如何处理win10系统火狐flash插件总是崩溃的问题，可能很多用户都不知

阅读：6568|2022-11-06

3 亲亲特价:怎么删除回收站图标

今天小编告诉大家如何对win10系统删除桌面回收站图标进行设置，可能很多用户都不知道

阅读：5458|2022-11-06

4 济南大学虚拟社区:鲁大师节能降温的具体办

今天小编告诉大家如何对win10系统电脑设置节能降温的设置方法，想必大家都遇到过需要

阅读：5938|2022-11-06

5 xlueops.exe:无线网络安装向导

我们在使用xp系统的过程中,经常需要对xp系统无线网络安装向导设置进行设置，可能很多

阅读：5816|2022-11-06

6 女斗合众国:win7系统cf与主机连接不稳定怎

今天小编告诉大家如何处理win7系统玩cf老是与主机连接不稳定的问题，可能很多用户都不

阅读：6196|2022-11-06

7 0xc000022-[cf烟雾头]cf怎么调烟雾头

电脑对日常生活的重要性小编就不多说了，可是一旦碰到win7系统设置cf烟雾头的问题，很

阅读：5773|2022-11-06

8 qizideyouhuo:应用程序无法正常启动0xc0000

我们在日常使用电脑的时候，有的小伙伴们可能在打开应用的时候会遇见提示应用程序无法

阅读：5241|2022-11-06

9 ipz-185:win7系统vcf文件怎么打开

今天小编告诉大家如何对win7系统打开vcf文件进行设置，可能很多用户都不知道怎么对win

阅读：5603|2022-11-06

10 傻哥蹦迪:win10系统s4怎么打开usb调试

今天小编告诉大家如何对win10系统s4开启USB调试模式进行设置，可能很多用户都不知道怎

阅读：4961|2022-11-06

客服电话

电子邮件

CVE-2022-31153

Current Description

Analysis Description

Severity

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

Initial Analysis 7/22/2022 12:38:26 PM

请发表评论

全部评论

上一篇：

下一篇：

krishnaik06/Machine-Learning-in-90-days

armancodv/building-energy-model-matlab:

美元符号为什么是“$”

FGRibreau/import-tweets-to-mastodon: How

IBM/differential-privacy-library: Diffpr

剪的笔顺,诠释剪的笔画,认识剪的部首

florent37/ViewAnimator: A fluent Android

florent37/Shrine-MaterialDesign2: implem

CVE-2020-36276

六六分期app的软件客服如何联系？(六六分期

doraiso/Mastodon

关于我们

产品与服务

解决方案

139-2527-9053