PT-2023-23572 · Vyper · Vyper

Highcharles-Cooper + 1 · Publicado 2023-05-11 · Atualizado 2023-08-02 · CVE-2023-32059

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.8

Description The issue concerns internal calls with default arguments in Vyper, a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, these calls are compiled incorrectly, adding default arguments from left-to-right instead of right-to-left. This can bypass type checking if the types are incompatible. The ability to pass kwargs to internal functions is an undocumented feature.

Recommendations For versions prior to 0.3.8, update to version 0.3.8 to resolve the issue. As a temporary workaround, consider avoiding the use of default arguments in internal calls or carefully reviewing the code to ensure type compatibility. Restrict the use of undocumented features, such as passing kwargs to internal functions, to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-683

Identificadores relacionados

CVE-2023-32059

GHSA-PH9X-4VC9-M39G

PYSEC-2023-79

Produtos afetados

Vyper

Referências · 9

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32059.json · Exploit
• https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac · Correção
• https://github.com/vyperlang/vyper · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-79.yaml · Nota
• https://osv.dev/vulnerability/CVE-2023-32059 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32059 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-79 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-ph9x-4vc9-m39g · Aviso do Fabricante