CVE-2023-30837

Published May 8, 2023

Last updated 2 years ago

Overview

Description: Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
Source: security-advisories@github.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-789

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4E33CC4B-8A7D-4AB9-91C6-7B103ED59531",
            "versionEndExcluding": "0.3.8"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References