CVE-2023-32058

描述

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.

如何修補 CVE-2023-32058

要修補 CVE-2023-32058,請將受影響套件升級到下列已修補版本。

• —升級至 0.3.8 或更新版本
• —升級至 3de1415ee77a9244eb04bdb695e249d3ec9ed868 或更新版本

CVE-2023-32058 正在被利用嗎?

低 — EPSS 為 0.9%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 0.3.8
• from 0, < 3de1415ee77a9244eb04bdb695e249d3ec9ed868 | from 0, < 0.3.8

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-32058
• PATCHgithub.com/vyperlang/vyper
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-78.yaml
• WEBgithub.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868