Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
657 results · page 2 of 14
Feb 1, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-24561 · Other software · vyperlang · reported by GitHubCritical 9.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-24567 · Other software · vyperlang · reported by GitHubMedium 4.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2024-22419 · Other software · vyperlang · reported by GitHubHigh 7.3
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur. This issue has been addressed in 0.4.0.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024Rust EVM is an Ethereum Virtual Machine interpreter.CVE-2024-21629 · Other software · rust-ethereum · reported by GitHubMedium 5.9
Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.
- Product
- evm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-46247 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`. The intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. Roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed by 1. If `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed by 1. This issue is patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum.CVE-2023-46232 · Other software · matter-labs · reported by GitHubMedium 5.3
era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue.
- Product
- era-compiler-vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) CVE-2023-42319 · Other software · ethereum · reported by MITREHigh 7.5
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.
- Product
- go_ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mevsec.comgeth.ethereum.org
Oct 13, 2023Frontier is Substrate's Ethereum compatibility layer.CVE-2023-45130 · Other software · paritytech · reported by GitHubHigh 7.5
Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses `storage::remove_prefix` (now renamed to `storage::clear_prefix`) to remove all storages associated with it. This is a single IO primitive call passing the WebAssembly boundary. For large contracts, the call (without providing a `limit` parameter) can be slow. In addition, for parachains, all storages to be deleted will be part of the PoV, which easily exceed relay chain PoV size limit. On the other hand, Frontier's maintainers only charge a fixed cost for opcode SUICIDE. The maintainers consider the severity of this issue high, because an attacker can craft a contract with a lot of storage values on a parachain, and then call opcode SUICIDE on the contract. If the transaction makes into a parachain block, the parachain will then stall because the PoV size will exceed relay chain's limit. This is especially an issue for XCM transactions, because they can't be skipped. Commit aea528198b3b226e0d20cce878551fd4c0e3d5d0 contains a patch for this issue. For parachains, it's
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-42443 · Other software · vyperlang · reported by GitHubHigh 8.1
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode. Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. As of time of publication,
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-42441 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.CVE-2023-36980 · Other software · Ethereum · reported by MITREMedium 5.3
An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.
- Product
- Blockchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordetherscan.iogithub.com
Sep 6, 2023go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol.CVE-2023-40591 · Other software · ethereum · reported by GitHubHigh 7.5
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- go-ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgeth.ethereum.orggithub.com
Aug 7, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-39363 · Other software · vyperlang · reported by GitHubCritical 9.1
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain.CVE-2023-38698 · Other software · ensdomains · reported by GitHubMedium 4.9
Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22. If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the red
- Product
- ens-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM).CVE-2023-37902 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature. Version 0.3.10 contains a patch for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2023-32675 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-32059 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-32058 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-31146 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2023-30629 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.vyperlang.orggithub.com
Apr 17, 2023@web3-react is a framework for building Ethereum Apps .CVE-2023-30543 · Other software · Uniswap · reported by GitHubMedium 5.2
@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- web3-react
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Frontier is an Ethereum compatibility layer for Substrate.CVE-2023-28431 · Other software · paritytech · reported by GitHubHigh 7.5
Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks. No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehCVE-2022-47547 · Other software · Protocol · reported by MITREMedium 5.3
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
- Product
- Gossipsub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine.CVE-2022-39354 · Other software · rust-blockchain · reported by GitHubMedium 5.9
SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses `is_static`. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.
- Product
- evm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Frontier is an Ethereum compatibility layer for Substrate.CVE-2022-39242 · Other software · paritytech · reported by GitHubMedium 5.3
Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. This issue has been patched in commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658. There are no known workarounds.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Besu is a Java-based Ethereum client.CVE-2022-36025 · Other software · hyperledger · reported by GitHubCritical 9.1
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations. This issue is patched in version 22.7.1. As a workaround, reverting to version 22.1.3 or earlier will prevent incorrect execution.
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Frontier is Substrate's Ethereum compatibility layer.CVE-2022-36008 · Other software · paritytech · reported by GitHubHigh 7.1
Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an overflow panic. No action is needed unless you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this. There are currently no known workarounds.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference CVE-2022-37450 · Other software · Ethereum · reported by MITREMedium 5.9
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.
- Product
- GO Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Ethermint is an Ethereum library.CVE-2022-35936 · Other software · evmos · reported by GitHubHigh 8.2
Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.
- Product
- ethermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022Frontier is Substrate's Ethereum compatibility layer.CVE-2022-31111 · Other software · paritytech · reported by GitHubMedium 5.3
Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value transferred. It is recommended that an emergency upgrade to be planned and EVM execution temporarily paused in the mean time. The issue is patched in Frontier master branch commit fed5e0a9577c10bea021721e8c2c5c378e16bf66 and polkadot-v0.9.22 branch commit e3e427fa2e5d1200a784679f8015d4774cedc934. This vulnerability affects only EVM internal states, but not Substrate balance states or node. You can temporarily pause EVM execution (by setting up a Substrate `CallFilter` that disables `pallet-evm` and `pallet-ethereum` calls before the patch can be applied.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp.CVE-2022-33069 · Other software · Soliditylang · reported by MITREMedium 5.5
Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp.
- Product
- Solidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-29255 · Other software · vyperlang · reported by GitHubHigh 8.2
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022Lodestar is a TypeScript implementation of the Ethereum Consensus specification.CVE-2022-29219 · Other software · ChainSafe · reported by GitHubHigh 7.5
Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted `AttesterSlashing` or `ProposerSlashing` being included on-chain. Because the developers represent `uint64` values as native javascript `number`s, there is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases, Lodestar may view valid_`AttesterSlashing` or `ProposerSlashing` as invalid, due to rounding errors in large `number` values. This causes a consensus split, where Lodestar nodes are forked away from the main network. Similarly, Lodestar may consider invalid `ProposerSlashing` as valid, thus including in proposed blocks that will be considered invalid by the network. Version 0.36.0 contains a fix for this issue. As a workaround, use `BigInt` to represent `Slot` and `Epoch` values in `AttesterSlashing` and `ProposerSlashing` objects. `BigInt` is too slow to be used in all `Slot` and `Epoch` cases, so one may carefully use `BigInt` just where necessary for consensus.
- Product
- lodestar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Go Ethereum is the official Golang implementation of the Ethereum protocol.CVE-2022-29177 · Other software · ethereum · reported by GitHubMedium 5.9
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.
- Product
- go-ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24845 · Other software · vyperlang · reported by GitHubHigh 8.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24788 · Other software · vyperlang · reported by GitHubHigh 7.1
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2022-24787 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to CVE-2021-42219 · Other software · Ethereum · reported by MITREHigh 7.5
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
- Product
- GO Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Mar 7, 2022Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network.CVE-2022-24738 · Other software · tharsis · reported by GitHubHigh 8.1
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- evmos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spendCVE-2022-23328 · Other software · Ethereum · reported by MITREHigh 7.5
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).
- Product
- GO Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.acm.orgtristartom.github.io
Mar 4, 2022A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which canCVE-2022-23327 · Other software · Ethereum · reported by MITREHigh 7.5
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).
- Product
- GO Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.acm.orgtristartom.github.io
Jan 14, 2022Frontier is Substrate's Ethereum compatibility layer.CVE-2022-21685 · Other software · paritytech · reported by GitHubMedium 6.5
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Besu is an Ethereum client written in Java.CVE-2021-41272 · Other software · hyperledger · reported by GitHubHigh 7.5
Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. In networks where only vulnerable versions are mining the relevant transaction will not be included in any blocks. When the network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this issue. Besu 21.7.4 is not vulnerable and clients can roll back to that version. There is a workaround available: Once a transaction with the relevant shift operations is inc
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered.CVE-2021-43668 · Other software · Ethereum · reported by MITREMedium 5.5
Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
- Product
- GO Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Go Ethereum is the official Golang implementation of the Ethereum protocol.CVE-2021-41173 · Other software · ethereum · reported by GitHubMedium 5.7
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading.
- Product
- go-ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (long-range consensus chain reorganizatCVE-2021-42766 · Other software · Proof-of-stake Ethereum Project · reported by MITRECritical 9.1
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (long-range consensus chain reorganizations), even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an increase in the profits of individual validators.
- Product
- Proof-of-stake Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite sCVE-2021-42765 · Other software · Proof-of-stake Ethereum Project · reported by MITREHigh 7.5
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite stalling of consensus decisions).
- Product
- Proof-of-stake Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (delayed consensus decisions), and alsoCVE-2021-42764 · Other software · Proof-of-stake Ethereum Project · reported by MITRECritical 9.1
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (delayed consensus decisions), and also increase the profits of individual validators, via short-range reorganizations of the underlying consensus chain.
- Product
- Proof-of-stake Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021The evm crate is a pure Rust implementation of Ethereum Virtual Machine.CVE-2021-41153 · Other software · rust-blockchain · reported by GitHubHigh 8.7
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`. This is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.
- Product
- evm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2021Frontier is Substrate's Ethereum compatibility layer.CVE-2021-41138 · Other software · paritytech · reported by GitHubMedium 5.3
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block. The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors. The issue is patched in commit `146bb48849e5393004be5c88beefe76fdf009aba`.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.