PT-2021-23105 · Vyper · Vyper

Charles-Cooper · Published 2021-10-05 · Updated 2023-08-02 · CVE-2021-41122

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.0

Description The issue arises from external functions not properly validating the bounds of decimal arguments, leading to potential logic errors.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 to resolve the issue. As a temporary workaround, consider avoiding the use of decimal arguments in external functions until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2021-41122

GHSA-C7PR-343R-5C46

PYSEC-2021-366

Affected Products

Vyper

References · 9

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-c7pr-343r-5c46 · Exploit
• https://osv.dev/vulnerability/GHSA-c7pr-343r-5c46 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41122 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-366 · Vendor Advisory
• https://github.com/vyperlang/vyper/pull/2447 · Note
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2021-366.yaml · Note
• https://t.me/cibsecurity/30019 · Telegram Post