CVE-2023-42441

MEDIUM5.3EPSS 0.15%

Vyper has incorrect re-entrancy lock when key is empty string

發布日:2023/9/18修改日:2024/11/22
也稱為:GHSA-3hg2-r75x-g69mPYSEC-2023-305

描述

### Impact Locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. ```Vyper @nonreentrant("") # unprotected @external def bar(): pass @nonreentrant("lock") # protected @external def foo(): pass ``` ### Patches Patched in #3605 ### Workarounds The lock name should be a non-empty string. ### References _Are there any links users can visit to find out more?_

受影響套件(2)

  • PyPI/vyper>= 0.2.9, < 0.3.10
  • PyPI/vyperfrom 0, < 0b740280c1e3c5528a20d47b29831948ddcc6d83 | >= 0.2.9, < 0.3.10

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

參考連結(6)