p PatchFirst

CVE-2023-42460

CVE-2023-42460 · _abi_decode input not validated in complex expressions in Vyper

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626.

CVSS 5.3 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • vyper

    Versions
    • >= 0.3.4, < 0.3.10: Affected

    No fix published

  • vyper PyPI

    Versions
    • 0.3.10rc1
    • 0.3.10rc2
    • 0.3.10rc3
    • 0.3.10rc4
    • 0.3.10rc5
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.3.4, < 0.3.10

    Update to 0.3.10

Original sources

Check your server →