GHSA-vqgp-4jgj-5j64

Suggest an improvement
Source
https://github.com/advisories/GHSA-vqgp-4jgj-5j64
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-vqgp-4jgj-5j64/GHSA-vqgp-4jgj-5j64.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vqgp-4jgj-5j64
Aliases
Published
2018-11-21T22:23:04Z
Modified
2024-10-21T20:51:34.054506Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Py-EVM is vulnerable to arbitrary bytecode injection
Details

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-119"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:58:10Z"
}
References

Affected packages

PyPI / py-evm

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.2.0a33

Affected versions

0.*

0.2.0a1
0.2.0a3
0.2.0a5
0.2.0a7
0.2.0a8
0.2.0a9
0.2.0a10
0.2.0a11
0.2.0a12
0.2.0a13
0.2.0a14
0.2.0a15
0.2.0a16
0.2.0a17
0.2.0a18
0.2.0a19
0.2.0a20
0.2.0a21
0.2.0a22
0.2.0a24
0.2.0a25
0.2.0a26
0.2.0a28
0.2.0a29
0.2.0a30
0.2.0a31
0.2.0a32
0.2.0a33