From c09a758deb38493a14b80799c6aa9065009f58f9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 20:23:10 +0000 Subject: [PATCH] Publish Advisories GHSA-3p37-3636-q8wv GHSA-6r8q-pfpv-7cgj GHSA-ph9x-4vc9-m39g --- .../GHSA-3p37-3636-q8wv.json | 65 +++++++++++++++++++ .../GHSA-6r8q-pfpv-7cgj.json | 65 +++++++++++++++++++ .../GHSA-ph9x-4vc9-m39g.json | 65 +++++++++++++++++++ 3 files changed, 195 insertions(+) create mode 100644 advisories/github-reviewed/2023/05/GHSA-3p37-3636-q8wv/GHSA-3p37-3636-q8wv.json create mode 100644 advisories/github-reviewed/2023/05/GHSA-6r8q-pfpv-7cgj/GHSA-6r8q-pfpv-7cgj.json create mode 100644 advisories/github-reviewed/2023/05/GHSA-ph9x-4vc9-m39g/GHSA-ph9x-4vc9-m39g.json diff --git a/advisories/github-reviewed/2023/05/GHSA-3p37-3636-q8wv/GHSA-3p37-3636-q8wv.json b/advisories/github-reviewed/2023/05/GHSA-3p37-3636-q8wv/GHSA-3p37-3636-q8wv.json new file mode 100644 index 00000000000..bb91eb9840c --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-3p37-3636-q8wv/GHSA-3p37-3636-q8wv.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3p37-3636-q8wv", + "modified": "2023-05-12T20:21:54Z", + "published": "2023-05-12T20:21:54Z", + "aliases": [ + "CVE-2023-31146" + ], + "summary": "Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment", + "details": "### Impact\nduring codegen, the length word of a dynarray is written before the data, which can result in OOB array access in the case where the dynarray is on both the lhs and rhs of an assignment. here is a minimal example producing the issue:\n```vyper\na:DynArray[uint256,3]\n@external\ndef test() -> DynArray[uint256,3]:\n self.a = [1,2,3]\n self.a = empty(DynArray[uint256,3])\n self.a = [self.a[0],self.a[1],self.a[2]]\n return self.a # return [1,2,3]\n```\n\nand here is an example demonstrating the issue can cause data corruption across call frames:\n\n```vyper\n@external\ndef test() -> DynArray[uint256,3]:\n self.a()\n return self.b() # return [1,2,3]\n\n@internal\ndef a():\n a: uint256 = 0 \n b: uint256 = 1 \n c: uint256 = 2 \n d: uint256 = 3\n\n@internal\ndef b() -> DynArray[uint256,3]:\n a: DynArray[uint256,3] = empty(DynArray[uint256,3])\n a = [a[0],a[1],a[2]]\n return a\n```\n\nexamples involving append and pop:\n```vyper\n@internal\ndef foo():\n c: DynArray[uint256, 1] = []\n c.append(c[0])\n```\n\n```vyper\n@internal\ndef foo():\n c: DynArray[uint256, 1] = [1]\n c[0] = c.pop()\n```\n\nthe expected behavior in all of the above cases is to revert due to oob array access.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nThe problem is patched at https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vyper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.3.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wv" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31146" + }, + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vyperlang/vyper" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:21:54Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-6r8q-pfpv-7cgj/GHSA-6r8q-pfpv-7cgj.json b/advisories/github-reviewed/2023/05/GHSA-6r8q-pfpv-7cgj/GHSA-6r8q-pfpv-7cgj.json new file mode 100644 index 00000000000..2a0aa57aadd --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-6r8q-pfpv-7cgj/GHSA-6r8q-pfpv-7cgj.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6r8q-pfpv-7cgj", + "modified": "2023-05-12T20:21:35Z", + "published": "2023-05-12T20:21:35Z", + "aliases": [ + "CVE-2023-32058" + ], + "summary": "Vyper vulnerable to integer overflow in loop", + "details": "### Impact\n\nDue to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter.\n\nIn the following example, calling `test` returns `354`, meaning that the variable `a` did store `354` a value out of bound for the type `uint8`.\n\n```Vyper\n@external\ndef test() -> uint16:\n x:uint8 = 255\n a:uint8 = 0\n for i in range(x, x+100):\n a = i\n return convert(a,uint16)\n```\n\nThe issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable.\n\nthanks to @trocher for reporting\n\n### Patches\n\nThe problem is patched at https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868\n\n### Workarounds\n\n ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vyper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.3.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32058" + }, + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vyperlang/vyper" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:21:35Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-ph9x-4vc9-m39g/GHSA-ph9x-4vc9-m39g.json b/advisories/github-reviewed/2023/05/GHSA-ph9x-4vc9-m39g/GHSA-ph9x-4vc9-m39g.json new file mode 100644 index 00000000000..bbe4c487e10 --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-ph9x-4vc9-m39g/GHSA-ph9x-4vc9-m39g.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph9x-4vc9-m39g", + "modified": "2023-05-12T20:21:00Z", + "published": "2023-05-12T20:21:00Z", + "aliases": [ + "CVE-2023-32059" + ], + "summary": "Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls", + "details": "### Impact\n\nInternal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments\nprovided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,\ntypechecking is bypassed. In the `bar()` function in the following code, `self.foo(13)` is compiled to\n`self.foo(13,12)` instead of `self.foo(13,1337)`.\n\n```vyper\n@internal\ndef foo(a:uint256 = 12, b:uint256 = 1337):\n pass\n\n@internal\ndef bar():\n self.foo(13)\n```\n\nnote that the ability to pass kwargs to internal functions is an undocumented feature that is not well known about.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nThe problem is patched at https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vyper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.3.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32059" + }, + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vyperlang/vyper" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-683" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:21:00Z", + "nvd_published_at": null + } +} \ No newline at end of file