Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1waDl4LTR2YzktbTM5Z84AAzUF

Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Impact

Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments
provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,
typechecking is bypassed. In the bar() function in the following code, self.foo(13) is compiled to
self.foo(13,12) instead of self.foo(13,1337).

@internal
def foo(a:uint256 = 12, b:uint256 = 1337):
    pass

@internal
def bar():
    self.foo(13)

note that at the time of publication, the ability to pass kwargs to internal functions is an undocumented feature that does not seem to be widely used.

Patches

patched in c3e68c302aa6e1429946473769dd1232145822ac

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Permalink: https://github.com/advisories/GHSA-ph9x-4vc9-m39g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1waDl4LTR2YzktbTM5Z84AAzUF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 11 months ago
Updated: 5 months ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-ph9x-4vc9-m39g, CVE-2023-32059
References: Repository: https://github.com/vyperlang/vyper

Affected Packages

pypi:vyper
Dependent packages: 3
Dependent repositories: 236
Downloads: 27,820 last month
Affected Version Ranges: < 0.3.8
Fixed in: 0.3.8
All affected versions: 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.2.11, 0.2.12, 0.2.13, 0.2.14, 0.2.15, 0.2.16, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7
All unaffected versions: 0.3.8, 0.3.9, 0.3.10