{"action":"Upgrade vyper to 0.3.8 or later.","affected":[{"fixed":"0.3.8","introduced":"0"}],"component":"vyper","cve_ids":["CVE-2023-30837"],"ecosystem":"PyPI","epss":0.00697,"exploited":false,"fixed_versions":["0.3.8"],"ghsa_id":"GHSA-mgv8-gggw-mrg6","id":"tcs_01M5KGKQMV2V2D6KGE1XGN6GS2","modified_at":"2023-11-08T04:12:26.960645Z","published_at":"2023-05-08T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-76","https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb","https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-76","url":"https://osv.dev/vulnerability/PYSEC-2023-76"}],"summary":"Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. Thi"}