PT-2023-28356 · Vyper · Vyper

Charles-Cooper + 1 · Published 2023-09-26 · Updated 2023-09-29 · CVE-2023-42460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.10

Description The abi decode() function in Vyper does not validate input when it is nested in an expression, allowing for bounds checking to be bypassed and resulting in incorrect results. This can be triggered by constructing specific examples where the output of abi decode is not internally passed to input validating routines.

Recommendations For versions prior to 0.3.10, update to version 0.3.10 to resolve the issue. As a temporary workaround, consider avoiding the use of abi decode() in nested expressions until the patch is applied. Restrict access to the abi decode() function to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2023-42460

GHSA-CX2Q-HFXR-RJ97

PYSEC-2023-191

Affected Products

Vyper

References · 10

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42460.json · Exploit
• https://github.com/vyperlang/vyper/pull/3626 · Patch
• https://osv.dev/vulnerability/CVE-2023-42460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42460 · Security Note
• https://osv.dev/vulnerability/GHSA-cx2q-hfxr-rj97 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-191 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-191.yaml · Note
• https://t.me/cibsecurity/71066 · Telegram Post