CVE-2023-42441mediumCWE-833

CVE-2023-42441: falha de média gravidade em vyperlang vyper

Vyper has incorrect re-entrancy lock when key is empty string

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar vyper+ Monitorar vyper

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
vyperlang · vyper
CVEs relacionadas — vyperlang vyper

No mesmo produto, das mais perigosas para as menos.

CVE-2024-24563CRITICALVyper array negative index vulnerabilityEPSS 1.5%CVE-2022-24845HIGHInteger bounds error in VyperEPSS 1.4%CVE-2022-29255HIGHMultiple evaluation of contract address in call in vyperEPSS 1.3%CVE-2023-31146HIGHVyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentEPSS 1.3%CVE-2021-41121HIGHMemory corruption in VyperEPSS 1.1%CVE-2022-24787HIGHIncorrect Comparison in VyperEPSS 1.0%