CVE-2023-32058

Description

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.

How to fix CVE-2023-32058

To remediate CVE-2023-32058, upgrade the affected package to a fixed version below.

• —upgrade to 0.3.8 or later
• —upgrade to 3de1415ee77a9244eb04bdb695e249d3ec9ed868 or later

Is CVE-2023-32058 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.3.8
• from 0, < 3de1415ee77a9244eb04bdb695e249d3ec9ed868 | from 0, < 0.3.8

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-32058
• PATCHgithub.com/vyperlang/vyper
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-78.yaml
• WEBgithub.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868