ByteOS Network

NVD Vulnerability Details :

CVE-2023-32059

Analyzed

Source-security-advisories@github.com

Published At-11 May, 2023 | 22:15

Updated At-02 Aug, 2023 | 16:22

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CPE Matches

vyperlang>>vyper>>Versions before 0.3.8(exclusive)

cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-683	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac	security-advisories@github.com	Patch
https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g	security-advisories@github.com	Exploit Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History