PT-2023-28356 · Vyper · Vyper

Charles-Cooper + 1 · Publicado 2023-09-26 · Atualizado 2023-09-29 · CVE-2023-42460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.10

Description The abi decode() function in Vyper does not validate input when it is nested in an expression, allowing for bounds checking to be bypassed and resulting in incorrect results. This can be triggered by constructing specific examples where the output of abi decode is not internally passed to input validating routines.

Recommendations For versions prior to 0.3.10, update to version 0.3.10 to resolve the issue. As a temporary workaround, consider avoiding the use of abi decode() in nested expressions until the patch is applied. Restrict access to the abi decode() function to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-682

Identificadores relacionados

CVE-2023-42460

GHSA-CX2Q-HFXR-RJ97

PYSEC-2023-191

Produtos afetados

Vyper

Referências · 10

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42460.json · Exploit
• https://github.com/vyperlang/vyper · Nota
• https://github.com/vyperlang/vyper/pull/3626 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-191.yaml · Nota
• https://t.me/cibsecurity/71066 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-42460 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42460 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-cx2q-hfxr-rj97 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-191 · Aviso do Fabricante