CVE-2021-41121

Advisory

Vyper version 0.3.0 includes a fix for CVE-2021-41121: In affected versions, when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack.
https://github.com/vyperlang/vyper/security/advisories/GHSA-xv8x-pr4h-73jv
https://github.com/vyperlang/vyper/pull/2447

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0. See CVE-2021-41121.


CONFIRM:https://github.com/vyperlang/vyper/security/advisories/GHSA-xv8x-pr4h-73jv: https://github.com/vyperlang/vyper/security/advisories/GHSA-xv8x-pr4h-73jv
MISC:https://github.com/vyperlang/vyper/pull/2447: https://github.com/vyperlang/vyper/pull/2447

Resources

• https://github.com/vyperlang/vyper/security/advisories/GHSA-xv8x-pr4h-73jv
• https://github.com/vyperlang/vyper/pull/2447
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41121