PT-2023-23572 · Vyper · Vyper

Highcharles-Cooper + 1 · Published 2023-05-11 · Updated 2023-08-02 · CVE-2023-32059

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.8

Description The issue concerns internal calls with default arguments in Vyper, a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, these calls are compiled incorrectly, adding default arguments from left-to-right instead of right-to-left. This can bypass type checking if the types are incompatible. The ability to pass kwargs to internal functions is an undocumented feature.

Recommendations For versions prior to 0.3.8, update to version 0.3.8 to resolve the issue. As a temporary workaround, consider avoiding the use of default arguments in internal calls or carefully reviewing the code to ensure type compatibility. Restrict the use of undocumented features, such as passing kwargs to internal functions, to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-683

Related Identifiers

CVE-2023-32059

GHSA-PH9X-4VC9-M39G

PYSEC-2023-79

Affected Products

Vyper

References · 9

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32059.json · Exploit
• https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac · Patch
• https://osv.dev/vulnerability/CVE-2023-32059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32059 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-79 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ph9x-4vc9-m39g · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-79.yaml · Note