id: PYSEC-2021-366
details: Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions
  external functions did not properly validate the bounds of decimal arguments. The
  can lead to logic errors. This issue has been resolved in version 0.3.0.
affected:
- package:
    name: vyper
    ecosystem: PyPI
    purl: pkg:pypi/vyper
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.3.0
  versions:
  - 0.1.0b1
  - 0.1.0b10
  - 0.1.0b11
  - 0.1.0b12
  - 0.1.0b13
  - 0.1.0b14
  - 0.1.0b15
  - 0.1.0b16
  - 0.1.0b17
  - 0.1.0b2
  - 0.1.0b3
  - 0.1.0b4
  - 0.1.0b5
  - 0.1.0b6
  - 0.1.0b7
  - 0.1.0b8
  - 0.1.0b9
  - 0.2.1
  - 0.2.10
  - 0.2.11
  - 0.2.12
  - 0.2.13
  - 0.2.14
  - 0.2.15
  - 0.2.16
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 0.2.6
  - 0.2.7
  - 0.2.8
  - 0.2.9
references:
- type: ADVISORY
  url: https://github.com/vyperlang/vyper/security/advisories/GHSA-c7pr-343r-5c46
- type: WEB
  url: https://github.com/vyperlang/vyper/pull/2447
aliases:
- CVE-2021-41122
- GHSA-c7pr-343r-5c46
modified: "2021-10-11T01:16:43.215640Z"
published: "2021-10-05T23:15:00Z"