CVE-2022-24787CWE-697

Incorrect Comparison in Vyper

High · published April 4, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
63.4
In the wild
Unconfirmed
What it is

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01029 · 63.4th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2022-04-04T17:35Z
EPSS history
Timeline
  • 04 APR 17:35Z
    Incorrect Comparison in Vyper
    cvelistv5