PT-2023-28342 · Vyper · Vyper

Charles-Cooper + 1 · Publicado 2023-09-18 · Atualizado 2023-09-21 · CVE-2023-42441

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.2.9 through 0.3.9

Description The issue concerns locks of the type @nonreentrant("") or @nonreentrant('') that do not produce reentrancy checks at runtime. This can be mitigated by ensuring the lock name is a non-empty string.

Recommendations For versions 0.2.9 through 0.3.9, ensure the lock name is a non-empty string as a workaround until the issue is resolved by updating to version 0.3.10 or later. For version 0.3.10 and later, no additional action is required as the issue is fixed in this version.

Exploit

Correção

Improper Locking

Enumeração de Fraquezas

CWE-667

CWE-833

Identificadores relacionados

CVE-2023-42441

GHSA-3HG2-R75X-G69M

PYSEC-2023-305

Produtos afetados

Vyper

Referências · 13

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-3hg2-r75x-g69m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42441.json · Exploit
• https://github.com/vyperlang/vyper/commit/0b740280c1e3c5528a20d47b29831948ddcc6d83 · Correção
• https://github.com/vyperlang/vyper/pull/3605 · Correção
• https://github.com/vyperlang/vyper · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-305.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2023-305 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42441 · Nota de Segurança
• https://t.me/cvenotify/58056 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-42441 · Aviso do Fabricante
• https://t.me/cibsecurity/70677 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1703868346775622018 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-3hg2-r75x-g69m · Aviso do Fabricante