CVE-2018-18920: Buffer Overflow
Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-18920?
CVE-2018-18920 is a vulnerability in Py-EVM v0.2.0-alpha.33 that allows attackers to trigger an execution failure by making a vm.execute_bytecode call with invalid opcode.
What is the severity of CVE-2018-18920?
The severity of CVE-2018-18920 is high with a CVSS score of 8.8.
How does CVE-2018-18920 affect the software?
CVE-2018-18920 affects Py-EVM v0.2.0-alpha.33 and Ethereum Py-evm 0.2.0-alpha.33.
How can I fix CVE-2018-18920?
To fix CVE-2018-18920, upgrade Py-EVM and Ethereum Py-evm to a version that fixes the vulnerability.
Where can I find more information about CVE-2018-18920?
You can find more information about CVE-2018-18920 on NIST NVD and GitHub.