PT-2022-16879 · Vyper · Vyper

Charles-Cooper · Published 2022-04-04 · Updated 2023-08-02 · CVE-2022-24787

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.1 and prior

Description The issue arises from the comparison of bytestrings, which can yield incorrect results due to the presence of dirty bytes or the lack of length comparison. Specifically, two bytestrings can compare as equal even if one ends with a null byte (x00) because the comparison does not account for the length of the bytestrings. This can lead to incorrect evaluations, such as b1 == b2 returning True when b1 and b2 are not identical.

Recommendations For Vyper versions 0.3.1 and prior, update to version 0.3.2 or later, which is expected to include the patch for this issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2022-24787

GHSA-7VRM-3JC8-5WWM

PYSEC-2022-196

Affected Products

Vyper

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24787.json · Exploit
• https://github.com/vyperlang/vyper/security/advisories/GHSA-7vrm-3jc8-5wwm · Patch
• https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24787 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24787 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7vrm-3jc8-5wwm · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2022-196.yaml · Note
• https://t.me/cibsecurity/40110 · Telegram Post