PT-2023-23951 · Vyper · Vyper

Charles-Cooper + 1 · Publicado 2023-05-19 · Atualizado 2023-10-26 · CVE-2023-32675

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.8

Description In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This issue was fixed by the removal of the global calldatasize check.

Recommendations For versions prior to 0.3.8, upgrade to version 0.3.8. For users unable to upgrade, avoid use of nonpayable default functions.

Exploit

Correção

Enumeração de Fraquezas

CWE-670

Identificadores relacionados

CVE-2023-32675

GHSA-VXMM-CWH2-Q762

PYSEC-2023-80

Produtos afetados

Vyper

Referências · 14

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32675.json · Exploit
• https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520. · Nota
• https://github.com/vyperlang/vyper · Nota
• https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520 · Correção
• https://github.com/vyperlang/vyper/commit/903727006c1e5ebef99fa9fd5d51d62bd33d72a9 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-80.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-32675 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vxmm-cwh2-q762 · Aviso do Fabricante
• https://t.me/cibsecurity/64472 · Publicação no Telegram
• https://t.me/cvenotify/50820 · Publicação no Telegram
• https://t.me/cvenotify/51206 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32675 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-80 · Aviso do Fabricante