ethers-cli (>=3.0.4, <=4.0.0), ethers-meow (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-19183 via ethereumjs-vm (>=2.3.1, <=2.3.5)

ethereumjs-vm NPM version =2.3.1, =3.0.4, =0.1.1, =0.0.1, =1.1.6, =1.1.41 - remix-solidity 0.0.1 Source cves: CVE-2018-19183 Source advisory: OSV:GHSA-2MW7-WGGM-M6W3...

CVE-2018-19183

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service vm.runCode failure and REVERT via a "code: Buffer.frommycode, 'hex'" attribute. NOTE: the vendor disputes this because REVERT is a normal bytecode that can be triggered from high-level source code, leading to a normal programmatic...

CVE-2018-19183

CVE-2018-19183 affects ethereumjs-vm 2.4.0. A DoS can be triggered by a code attribute set to Buffer.from(my_code, 'hex'), causing vm.runCode failure and REVERT. The vendor disputes the interpretation, noting REVERT can result from normal bytecode when triggered from high-level code. Connected ad...