{"action":"Upgrade vyper to 0.3.9 or later.","affected":[{"fixed":"0.3.9","introduced":"0"}],"component":"vyper","cve_ids":["CVE-2023-37902"],"ecosystem":"PyPI","epss":0.00574,"exploited":false,"fixed_versions":["0.3.9"],"ghsa_id":"GHSA-f5x6-7qgp-jhf3","id":"tcs_01M5KGJEZN27NG5PHXAZNNP75M","modified_at":"2023-11-08T04:13:03.946034Z","published_at":"2023-07-25T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-133","https://github.com/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3","https://github.com/vyperlang/vyper/commit/019a37ab98ff53f04fecfadf602b6cd5ac748f7f"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2023-133","url":"https://osv.dev/vulnerability/PYSEC-2023-133"}],"summary":"Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not ve"}