Py-EVM is vulnerable to arbitrary bytecode injection

2018-11-2122:23:04

Google

osv.dev

0.009 Low

EPSS

Percentile

82.8%

JSON

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with ‘“stack”: [100, 100, 0]’ where b’\x’ was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to “smart contracts can be executed indefinitely without gas being paid.”

CPENameOperatorVersion
py-evmeq0.2.0a19
py-evmeq0.2.0a3
py-evmeq0.2.0a7
py-evmeq0.2.0a16
py-evmeq0.2.0a22
py-evmeq0.2.0a11
py-evmeq0.2.0a15
py-evmeq0.2.0a29
py-evmeq0.2.0a10
py-evmeq0.2.0a24

Name	Operator	Version
py-evm	eq	0.2.0a19
py-evm	eq	0.2.0a3
py-evm	eq	0.2.0a7
py-evm	eq	0.2.0a16
py-evm	eq	0.2.0a22
py-evm	eq	0.2.0a11
py-evm	eq	0.2.0a15
py-evm	eq	0.2.0a29
py-evm	eq	0.2.0a10
py-evm	eq	0.2.0a24