What is GHSA-22wc-c9wj-6q2v?

GHSA-22wc-c9wj-6q2v is a security advisory published by GitHub Security Advisories with Medium severity. VVE-2021-0001: Memory corruption using function calls within arrays

Why does GHSA-22wc-c9wj-6q2v have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-22wc-c9wj-6q2v?

GHSA-22wc-c9wj-6q2v affects 1 product, including: pip/vyper:\u003c 0.2.12.

GHSA-22wc-c9wj-6q2vMediumDisclosed before NVD

VVE-2021-0001: Memory corruption using function calls within arrays

Vendor

GitHub Security Advisories

Published

April 19, 2021

Last Modified

January 9, 2023

📋 Description

Impact

When performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack.

Patches

This issue was partially fixed in VVE-2020-0004, however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345

🎯 Affected products1

pip/vyper:< 0.2.12

🔗 References (5)

https://github.com/vyperlang/vyper/security/advisories/GHSA-22wc-c9wj-6q2v
https://github.com/vyperlang/vyper/pull/2345
https://github.com/vyperlang/vyper/commit/11b7b5b7e59bc9dc859d51cd41a924b59fe47c9e
https://pypi.org/project/vyper
https://github.com/advisories/GHSA-22wc-c9wj-6q2v