pysec - pysec-2018-96

PYSEC-2018-96

Vulnerability from pysec - Published: 2018-11-12 02:29 - Updated: 2021-08-27 03:22

Details

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."

Impacted products

Name	purl
py-evm	pkg:pypi/py-evm

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "py-evm",
        "purl": "pkg:pypi/py-evm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.0a33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.0a1",
        "0.2.0a10",
        "0.2.0a11",
        "0.2.0a12",
        "0.2.0a13",
        "0.2.0a14",
        "0.2.0a15",
        "0.2.0a16",
        "0.2.0a17",
        "0.2.0a18",
        "0.2.0a19",
        "0.2.0a20",
        "0.2.0a21",
        "0.2.0a22",
        "0.2.0a24",
        "0.2.0a25",
        "0.2.0a26",
        "0.2.0a28",
        "0.2.0a29",
        "0.2.0a3",
        "0.2.0a30",
        "0.2.0a31",
        "0.2.0a32",
        "0.2.0a5",
        "0.2.0a7",
        "0.2.0a8",
        "0.2.0a9"
      ]
    }
  ],
  "aliases": [
    "CVE-2018-18920",
    "GHSA-vqgp-4jgj-5j64"
  ],
  "details": "Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with \u0027\"stack\": [100, 100, 0]\u0027 where b\u0027\\x\u0027 was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"",
  "id": "PYSEC-2018-96",
  "modified": "2021-08-27T03:22:16.474976Z",
  "published": "2018-11-12T02:29:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/NettaLab/status/1060889400102383617"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/AlexanderFisher/status/1060923428641878019"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ethereum/py-evm/issues/1448"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-vqgp-4jgj-5j64"
    }
  ]
}

GHSA-VQGP-4JGJ-5J64

Vulnerability from github – Published: 2018-11-21 22:23 – Updated: 2024-10-21 20:22

Summary

Py-EVM is vulnerable to arbitrary bytecode injection

Details

Severity ?

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "py-evm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.2.0a33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-18920"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:58:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with \u0027\"stack\": [100, 100, 0]\u0027 where b\u0027\\x\u0027 was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"",
  "id": "GHSA-vqgp-4jgj-5j64",
  "modified": "2024-10-21T20:22:22Z",
  "published": "2018-11-21T22:23:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18920"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethereum/py-evm/issues/1448"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-vqgp-4jgj-5j64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ethereum/py-evm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/py-evm/PYSEC-2018-96.yaml"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/AlexanderFisher/status/1060923428641878019"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/NettaLab/status/1060889400102383617"
    },
    {
      "type": "WEB",
      "url": "https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Py-EVM is vulnerable to arbitrary bytecode injection"
}

CVE-2018-18920 (GCVE-0-2018-18920)

Vulnerability from cvelistv5 – Published: 2018-11-12 02:00 – Updated: 2024-08-05 11:23

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://twitter.com/AlexanderFisher/status/106092…	x_refsource_MISC
	https://github.com/ethereum/py-evm/issues/1448	x_refsource_MISC
	https://twitter.com/NettaLab/status/1060889400102383617	x_refsource_MISC
	https://www.reddit.com/r/ethereum/comments/9vkk2g…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:23:08.555Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/AlexanderFisher/status/1060923428641878019"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ethereum/py-evm/issues/1448"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/NettaLab/status/1060889400102383617"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-11-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with \u0027\"stack\": [100, 100, 0]\u0027 where b\u0027\\x\u0027 was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-12T02:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/AlexanderFisher/status/1060923428641878019"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ethereum/py-evm/issues/1448"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/NettaLab/status/1060889400102383617"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18920",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with \u0027\"stack\": [100, 100, 0]\u0027 where b\u0027\\x\u0027 was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://twitter.com/AlexanderFisher/status/1060923428641878019",
              "refsource": "MISC",
              "url": "https://twitter.com/AlexanderFisher/status/1060923428641878019"
            },
            {
              "name": "https://github.com/ethereum/py-evm/issues/1448",
              "refsource": "MISC",
              "url": "https://github.com/ethereum/py-evm/issues/1448"
            },
            {
              "name": "https://twitter.com/NettaLab/status/1060889400102383617",
              "refsource": "MISC",
              "url": "https://twitter.com/NettaLab/status/1060889400102383617"
            },
            {
              "name": "https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/",
              "refsource": "MISC",
              "url": "https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18920",
    "datePublished": "2018-11-12T02:00:00",
    "dateReserved": "2018-11-03T00:00:00",
    "dateUpdated": "2024-08-05T11:23:08.555Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2018-96

GHSA-VQGP-4JGJ-5J64

CVE-2018-18920 (GCVE-0-2018-18920)

Tags

Sightings

Nomenclature