PyPI/vyper CVE-2023-30837: unknown, EPSS 0.70%

Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. Thi

Action: Upgrade vyper to 0.3.8 or later.

pip install vyper==0.3.8

Affected

Fixed versions

Sources

• osv: PYSEC-2023-76
• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb
• https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6

CVE-2023-30837 · published 2023-05-08T17:15:00Z · modified 2023-11-08T04:12:26.960645Z · JSON