CVE-2018-15560

Advisory

Web3 4.7.0 upgrades eth-hash to 0.2.0 with pycryptodome 3.6.6 which resolves a vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

--------

Released September 5th, 2018

- Features

- Add traceFilter method to the parity module.
- `1051 <https://github.com/ethereum/web3.py/pull/1051>`_
- Move :module:`~web3.utils.datastructures` to public namespace :module:`~web3.datastructures`
to improve support for type checking.
- `1038 <https://github.com/ethereum/web3.py/pull/1038>`_
- Optimization to contract calls
- `944 <https://github.com/ethereum/web3.py/pull/944>`_
- Bugfixes

- ENS name resolution only attempted on mainnet by default.
- `1037 <https://github.com/ethereum/web3.py/pull/1037>`_
- Fix attribute access error when attributedict middleware is not used.
- `1040 <https://github.com/ethereum/web3.py/pull/1040>`_
- Misc
- Upgrade eth-tester to 0.1.0-beta.32, and remove integration tests for py-ethereum.
- Upgrade eth-hash to 0.2.0 with pycryptodome 3.6.6 which resolves a vulnerability.

Resources

• https://pypi.org/project/web3
• https://pyup.io/changelogs/web3/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15560