VulnerabilityModified
CVE-2023-30837
The storage allocator does not guard against allocation overflows in versions prior to 0.3.8.
HIGH 7.5EPSS 0.70%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.70% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-789
- Affected
- vyperlang/vyper
- Source
- security-advisories@github.com
References
- https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bbPatch
- https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6Exploit, Vendor Advisory
- https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bbPatch
- https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.