p PatchFirst

CVE-2020-37286

CVE-2020-37286 · Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

CVSS 8.3 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • vyper

    Versions
    • ≥ 0.1.0b4, < 0.3.0: Affected (python)
    • 0.3.0: Not affected (python)

    Update to 0.3.0

  • vyper PyPI

    Versions
    • 0.1.0b1
    • 0.1.0b10
    • 0.1.0b11
    • 0.1.0b12
    • 0.1.0b13
    • 0.1.0b14
    • 0.1.0b15
    • 0.1.0b16
    • 0.1.0b17
    • 0.1.0b2
    • 0.1.0b3
    • 0.1.0b4
    • 0.1.0b5
    • 0.1.0b6
    • 0.1.0b7
    • 0.1.0b8
    • 0.1.0b9
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    Affected ranges
    • ECOSYSTEM: < 0.2.6

    Update to 0.2.6

Original sources

Check your server →