https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 00:30:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221618 EUVD-2026-221618 https://cve.radiocsirt.org/vuln/euvd-2026-221618 https://cve.radiocsirt.org/vuln/fkie_cve-2023-23940 <p>OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.</p> <p>OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-23940 https://cve.radiocsirt.org/vuln/ghsa-626q-v9j4-mcp4 <p><strong>Affected:</strong> PyPI: openzeppelin-cairo-contracts</p> <p>### Cause `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`.</p> <p>### Impact As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts.</p> <p>### Risk In order to exploit this vulnerability, it is required to control a sequencer or prover since they&#39;re the ones executing the hints, being able to inject incorrect keccak results.</p> <p>Today StarkWare is the only party running both a prover or a sequencer, greatly reducing the risk of exploit.</p> <p>### Patches The issue has been patched in 0.6.1.</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [the Contracts for Cairo repository](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose) * Email us at [security@openzeppelin.com](mailto:security@openzeppelin.com)</p> <p><strong>Affected:</strong> PyPI: openzeppelin-cairo-contracts</p> <p>### Cause `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`.</p> <p>### Impact As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts.</p> <p>### Risk In order to exploit this vulnerability, it is required to control a sequencer or prover since they&#39;re the ones executing the hints, being able to inject incorrect keccak results.</p> <p>Today StarkWare is the only party running both a prover or a sequencer, greatly reducing the risk of exploit.</p> <p>### Patches The issue has been patched in 0.6.1.</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [the Contracts for Cairo repository](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose) * Email us at [security@openzeppelin.com](mailto:security@openzeppelin.com)</p> https://cve.radiocsirt.org/vuln/ghsa-626q-v9j4-mcp4 https://cve.radiocsirt.org/vuln/gsd-2023-23940 gsd-2023-23940 https://cve.radiocsirt.org/vuln/gsd-2023-23940 https://cve.radiocsirt.org/vuln/pysec-2023-39 <p><strong>Affected:</strong> PyPI: openzeppelin-cairo-contracts</p> <p>OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.</p> <p><strong>Affected:</strong> PyPI: openzeppelin-cairo-contracts</p> <p>OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.</p> https://cve.radiocsirt.org/vuln/pysec-2023-39