CVE-2023-42460

Advisory

Vyper versions before 0.3.10 are affected by CVE-2023-42460: The '_abi_decode()' function does not validate input when it is nested in an expression. Uses of '_abi_decode()' can be constructed which allow for bounds checking to be bypassed resulting in incorrect results.
https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626. See CVE-2023-42460.


MISC:https://github.com/vyperlang/vyper/pull/3626: https://github.com/vyperlang/vyper/pull/3626
MISC:https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97: https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97

Resources

• https://github.com/vyperlang/vyper/pull/3626
• https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42460