GitHub Advisoryadvisory · PyPI

GHSA-4mrx-6fxm-8jpg Buffer Overflow in vyper

HIGH Published 2022-04-20 Modified 2024-11-19 Official page ↗
Aliases
CVE-2022-24788
Ecosystem
PyPI
Packages
vyper
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weaknesses
CWE-119, CWE-120
Reviewed
2022-04-20

Affected packages

• PyPI vyper: < 0.3.2 → fixed in 0.3.2

Description

Impact Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Patches 0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b) Workarounds Use .vy interfaces.

Related

Alias · CVE (1)

  • CVE-2022-24788 Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-120 Buffer Copy without Checking Size of Input weakness

References