CVE-2023-42441

MEDIUM5.3EPSS 0.15%

Vyper has incorrect re-entrancy lock when key is empty string

Published: 9/18/2023Modified: 11/22/2024

Description

### Impact Locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. ```Vyper @nonreentrant("") # unprotected @external def bar(): pass @nonreentrant("lock") # protected @external def foo(): pass ``` ### Patches Patched in #3605 ### Workarounds The lock name should be a non-empty string. ### References _Are there any links users can visit to find out more?_

Affected packages (2)

  • PyPI/vyper>= 0.2.9, < 0.3.10
  • PyPI/vyperfrom 0, < 0b740280c1e3c5528a20d47b29831948ddcc6d83 | >= 0.2.9, < 0.3.10

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References (6)