3 matches found
ape-dasy (0.1.0), ape-safe (0.6.0) +20 more potentially affected by CVE-2024-22419 via vyper (>=0.3.0, <=0.3.10)
vyper PYPI version =0.3.0, =0.7.1, =0.5.0, =0.5.0, =0.2.0, =0.1.0, =0.7.2, =0.1.10.0, =1.0.1, =0.1.0, =1.17.0, =2.1.6, =0.6.0, =0.8.23 and more Source cves: CVE-2024-22419 Source advisory: OSV:GHSA-2Q8V-3GQQ-4F8P...
ape-dasy (0.1.0), ape-safe (0.6.0) +20 more potentially affected by CVE-2024-22419 via vyper (>=0.3.0, <=0.3.10)
vyper PYPI version =0.3.0, =0.7.1, =0.5.0, =0.5.0, =0.2.0, =0.1.0, =0.7.2, =0.1.10.0, =1.0.1, =0.1.0, =1.17.0, =2.1.6, =0.6.0, =0.8.23 and more Source cves: CVE-2024-22419 Source advisory: MEND:CVE-2024-22419...
CVE-2024-22419
CVE-2024-22419 affects the Vyper compiler/runtime: the built-in concat can write past the allocated memory buffer, potentially corrupting memory and changing contract semantics. The root cause is the build_IR path not properly conforming to the copy_bytes API for versions >= 0.3.2, enabling a ...