CVE-2023-32058

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8. See CVE-2023-32058.


MISC:https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868: https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
MISC:https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj: https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj

Resources

• https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
• https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32058