Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 19 April 2021.
- Which products and versions are affected?
- vyper (PyPI) ECOSYSTEM:introduced=0,fixed=0.2.12.
- Is there a fix for This vulnerability?
- Yes. vyper (PyPI): upgrade to 0.2.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked with local access.
- Am I affected?
- Check whether you run vyper (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- vyper (PyPI): upgrade to 0.2.12 or later
pip install "vyper>=0.2.12"
Technical details
A memory corruption vulnerability (CWE-129) exists in Vyper's handling of function calls within arrays. The issue stems from an incorrect pointer to the stack tip during array element evaluation with nested function calls. This vulnerability was partially addressed in a prior fix (VVE-2020-0004) but similar vulnerable code patterns in array handling were missed. The flaw occurs at compile-time when processing Vyper source code; no runtime attack vector or authentication is required. An attacker controlling Vyper source code can trigger memory corruption during compilation, potentially leading to undefined behavior or malicious bytecode generation. The issue is fixed in Vyper version 0.2.12 and later (PR #2345).
Affected products
- Vyper Vyper before 0.2.12
Timeline
- 2021-04-19: disclosed: Advisory GHSA-22wc-c9wj-6q2v published
- 2021-04-11: patched: Fix merged in PR #2345; patched version 0.2.12 released