CVE-2022-24787 Incorrect Comparison in Vyper

What is CVE-2022-24787?

CVE-2022-24787 is a high-severity vulnerability in vyperlang vyper, published on 4 Apr 2022.

Official description

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.

Weakness: CWE-697

Which versions are affected by CVE-2022-24787?

3 open source packages ship an affected version, including vyper. It affects 1 product.

Products include Vyperlang Vyper.

How do I fix CVE-2022-24787?

Upgrade vyper to 0.3.2 or later.

Is CVE-2022-24787 being exploited?

There is no known exploitation of CVE-2022-24787 in the wild and no public exploit code.

Other vulnerabilities in vyperlang vyper

• CVE-2024-24563 Vyper array negative index vulnerability Critical 9.8
• CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed Critical 9.8
• CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks Critical 9.1
• CVE-2022-24845 Integer bounds error in Vyper High 8.8
• CVE-2022-29255 Multiple evaluation of contract address in call in vyper High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7vrm-3jc8-5wwm, PYSEC-2022-196.