CVE-2022-24788

描述

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.

如何修補 CVE-2022-24788

要修補 CVE-2022-24788,請將受影響套件升級到下列已修補版本。

• —升級至 0.3.2 或更新版本
• —升級至 049dbdc647b2ce838fae7c188e6bb09cf16e470b 或更新版本

CVE-2022-24788 正在被利用嗎?

低 — EPSS 為 0.9%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 0.3.2
• from 0, < 049dbdc647b2ce838fae7c188e6bb09cf16e470b | from 0, < 0.3.2

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-24788
• PATCHgithub.com/vyperlang/vyper
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2022-197.yaml
• WEBgithub.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b