Medium severity · published Sep 4, 2023
CVE-2023-41052
Vyper is a Pythonic Smart Contract Language
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
Vyper · Vyperlang
through 0.3.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41052
Patch
https://github.com/vyperlang/vyper/pull/3583
Exploit
https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq
More from Vyper
9.8
CVE-2024-24563
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2024-24561
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2024-22419
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
