GHSA-c7pr-343r-5c46MediumCVSS 4.3

missing clamps for decimal args in external functions

Published
October 6, 2021
Last Modified
November 18, 2024

🔗 CVE IDs covered (1)

CVE-2021-41122 →

📋 Description

Impact

The following code does not properly validate that its input is in bounds.

@external
def foo(x: decimal) -> decimal:
    return x

Patches

0.3.0 / #2447

Workarounds

Don't use decimal args

🎯 Affected products1

  • pip/vyper:< 0.3.0

🔗 References (5)