PT-2023-22992 · Vyper · Vyper

Toon Vanhove + 1 · Publicado 2023-05-05 · Atualizado 2023-08-02 · CVE-2023-30837

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.8

Description The storage allocator in Vyper does not guard against allocation overflows, allowing an attacker to overwrite the owner variable. This issue can be exploited by calling a contract with specific calldata, enabling the attacker to modify the owner variable. The issue was fixed in version 0.3.8.

Recommendations For versions prior to 0.3.8, update to version 0.3.8 to resolve the issue. As a temporary workaround, consider restricting access to the foo function until the update is applied. Avoid using the buffer variable in the affected contract until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

CVE-2023-30837

GHSA-MGV8-GGGW-MRG6

PYSEC-2023-76

Produtos afetados

Vyper

Referências · 12

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30837.json · Exploit
• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb · Correção
• https://github.com/vyperlang/vyper · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-76.yaml · Nota
• https://osv.dev/vulnerability/CVE-2023-30837 · Aviso do Fabricante
• https://t.me/cvenotify/50652 · Publicação no Telegram
• https://t.me/cvenotify/49951 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30837 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mgv8-gggw-mrg6 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-76 · Aviso do Fabricante
• https://t.me/cibsecurity/63451 · Publicação no Telegram