p PatchFirst

CVE-2023-42441

CVE-2023-42441 · Vyper has incorrect re-entrancy lock when key is empty string

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • vyper

    Versions
    • >= 0.2.9, < 0.3.10: Affected

    No fix published

  • vyper PyPI

    Versions
    • 0.2.10
    • 0.2.11
    • 0.2.12
    • 0.2.13
    • 0.2.14
    • 0.2.15
    • 0.2.16
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.3.10rc1
    • 0.3.10rc2
    • 0.3.10rc3
    • 0.3.10rc4
    • 0.3.10rc5
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.2.9, < 0.3.10

    Update to 0.3.10

  • vyper PyPI

    Versions
    • 0.2.10
    • 0.2.11
    • 0.2.12
    • 0.2.13
    • 0.2.14
    • 0.2.15
    • 0.2.16
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.3.10rc1
    • 0.3.10rc2
    • 0.3.10rc3
    • 0.3.10rc4
    • 0.3.10rc5
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    Affected ranges
    • GIT: < 0b740280c1e3c5528a20d47b29831948ddcc6d83
    • ECOSYSTEM: ≥ 0.2.9, < 0.3.10

    Update to 0.3.10

Original sources

Check your server →