CVE-2021-41122: missing clamps for decimal args in external functions

October 6, 2021 (updated November 18, 2024)

The following code does not properly validate that its input is in bounds.

@external
def foo(x: decimal) -> decimal:
return x

References

github.com/advisories/GHSA-c7pr-343r-5c46
github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2021-366.yaml
github.com/vyperlang/vyper
github.com/vyperlang/vyper/pull/2447
github.com/vyperlang/vyper/security/advisories/GHSA-c7pr-343r-5c46
nvd.nist.gov/vuln/detail/CVE-2021-41122

Code Behaviors & Features

Detect and mitigate CVE-2021-41122 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →