id: PYSEC-2018-96
details: 'Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call
  that triggers computation._stack.values with ''"stack": [100, 100, 0]'' where b''\x''
  was expected, resulting in an execution failure because of an invalid opcode. This
  is reportedly related to "smart contracts can be executed indefinitely without gas
  being paid."'
affected:
- package:
    name: py-evm
    ecosystem: PyPI
    purl: pkg:pypi/py-evm
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 0.2.0a33
  versions:
  - 0.2.0a1
  - 0.2.0a10
  - 0.2.0a11
  - 0.2.0a12
  - 0.2.0a13
  - 0.2.0a14
  - 0.2.0a15
  - 0.2.0a16
  - 0.2.0a17
  - 0.2.0a18
  - 0.2.0a19
  - 0.2.0a20
  - 0.2.0a21
  - 0.2.0a22
  - 0.2.0a24
  - 0.2.0a25
  - 0.2.0a26
  - 0.2.0a28
  - 0.2.0a29
  - 0.2.0a3
  - 0.2.0a30
  - 0.2.0a31
  - 0.2.0a32
  - 0.2.0a5
  - 0.2.0a7
  - 0.2.0a8
  - 0.2.0a9
references:
- type: WEB
  url: https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/
- type: WEB
  url: https://twitter.com/NettaLab/status/1060889400102383617
- type: WEB
  url: https://twitter.com/AlexanderFisher/status/1060923428641878019
- type: REPORT
  url: https://github.com/ethereum/py-evm/issues/1448
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vqgp-4jgj-5j64
aliases:
- CVE-2018-18920
- GHSA-vqgp-4jgj-5j64
modified: '2021-08-27T03:22:16.474976Z'
published: '2018-11-12T02:29:00Z'