CVE-2023-37902
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2023-37902 is a vulnerability affecting the Vyper programming language prior to version 0.3.10, which targets the Ethereum Virtual Machine (EVM). The issue lies in the ecrecover precompile, where if the signature does not verify, the output buffer is not filled. However, the ecrecover builtin still returns whatever is at memory location 0. This means that by manipulating data at memory location 0 just before the ecrecover, a signature check might pass on an invalid signature. The vulnerability has a risk score of 25 and a base severity of MEDIUM. To remediate it, users should update to version 0.3.10 or later. This vulnerability poses a potential danger to organizations using Vyper as it could lead to passing invalid signatures and compromising security.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions