Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jN3ByLTM0M3ItNWM0Ns0WLg

missing clamps for decimal args in external functions

Impact

The following code does not properly validate that its input is in bounds.

@external
def foo(x: decimal) -> decimal:
    return x

Patches

0.3.0 / #2447

Workarounds

Don't use decimal args

Permalink: https://github.com/advisories/GHSA-c7pr-343r-5c46
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jN3ByLTM0M3ItNWM0Ns0WLg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: about 2 months ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS Percentage: 0.00054
EPSS Percentile: 0.23785

Identifiers: GHSA-c7pr-343r-5c46, CVE-2021-41122
References:

• https://github.com/vyperlang/vyper/security/advisories/GHSA-c7pr-343r-5c46
• https://github.com/vyperlang/vyper/pull/2447
• https://nvd.nist.gov/vuln/detail/CVE-2021-41122
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2021-366.yaml
• https://github.com/advisories/GHSA-c7pr-343r-5c46

Repository: https://github.com/vyperlang/vyper
Blast Radius: 10.2

Affected Packages