CVE-2023-37902

描述

Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature. Version 0.3.10 contains a patch for this issue.

如何修補 CVE-2023-37902

要修補 CVE-2023-37902,請將受影響套件升級到下列已修補版本。

• —升級至 0.3.10 或更新版本
• —升級至 019a37ab98ff53f04fecfadf602b6cd5ac748f7f 或更新版本

CVE-2023-37902 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 0.3.10
• from 0, < 019a37ab98ff53f04fecfadf602b6cd5ac748f7f | from 0, < 0.3.9

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-37902
• PATCHgithub.com/vyperlang/vyper
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-133.yaml
• WEBgithub.com/vyperlang/vyper/commit/019a37ab98ff53f04fecfadf602b6cd5ac748f7f