GHSA-vqgp-4jgj-5j64

Py-EVM is vulnerable to arbitrary bytecode injection

Source: GitHub Advisory Database (reviewed) High CVE-2018-18920

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	py-evm	<= 0.2.0a33	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-18920 advisory
https://github.com/ethereum/py-evm/issues/1448 web
https://github.com/advisories/GHSA-vqgp-4jgj-5j64 advisory
https://github.com/ethereum/py-evm package
https://github.com/pypa/advisory-database/tree/main/vulns/evm-py/PYSEC-2018-155.yaml web
https://github.com/pypa/advisory-database/tree/main/vulns/py-evm/PYSEC-2018-96.yaml web
https://twitter.com/AlexanderFisher/status/1060923428641878019 web
https://twitter.com/NettaLab/status/1060889400102383617 web
https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx web