// For flags

CVE-2022-24787

Incorrect Comparison in Vyper

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.

Vyper es un Lenguaje de Contratos Inteligentes de Python para la Máquina Virtual de Ethereum. En versiones 0.3.1 y anteriores, las cadenas de bytes pueden presentar bytes sucios, resultando en que las comparaciones palabra por palabra den resultados incorrectos. Incluso sin bytes sucios distintos de cero, dos bytestrings pueden compararse como iguales si uno termina con "\x00" porque no se presenta comparación de la longitud. Se presenta un parche disponible y es esperado que forme parte de la versión 0.3.2. Actualmente no se presentan medidas de mitigación conocidas

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-04-04 CVE Published
  • 2023-10-26 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-697: Incorrect Comparison
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vyperlang
Search vendor "Vyperlang"
Vyper
Search vendor "Vyperlang" for product "Vyper"
<= 0.3.1
Search vendor "Vyperlang" for product "Vyper" and version " <= 0.3.1"
-
Affected