CVE-2023-42460
Summary
| CVE | CVE-2023-42460 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-27 15:19:00 UTC |
| Updated | 2023-09-29 18:41:00 UTC |
| Description | Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626. |
Risk And Classification
Problem Types: CWE-682
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| fix: `_abi_decode()` validation by charles-cooper · Pull Request #3626 · vyperlang/vyper · GitHub | MISC | github.com | |
| _abi_decode input not validated in certain complex expressions · Advisory · vyperlang/vyper · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 995442 Python (Pip) Security Update for vyper (GHSA-cx2q-hfxr-rj97)