[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2024-32645":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":25,"references":28,"score":33,"epss_score":34,"epss_percentile":35,"is_kev":36,"cisa_kev_date_added":37,"cisa_kev_due_date":37,"cisa_ssvc":38,"attack_mappings":48,"exploits":55},36468,"CVE-2024-32645","EUVD-2024-0182","vyper performs incorrect topic logging in raw_log\n\n### Summary\nIncorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics.\n\nA contract search was performed and no vulnerable contracts were found in production. In particular, no uses of `raw_log()` were found at all in production; it is apparently not a well-known function.\n\n### Details\nThe `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics.\n\n### PoC\n```vyper\nx: bytes32\n\n@external\ndef f():\n    self.x = 0x1234567890123456789012345678901234567890123456789012345678901234\n    raw_log([self.x], b\"\") # LOG1(offset:0x60, size:0x00, topic1:0x00)\n\n    y: bytes32 = 0x1234567890123456789012345678901234567890123456789012345678901234\n    raw_log([y], b\"\") # LOG1(offset:0x80, size:0x00, topic1:0x40)\n```\n### Patches\nFixed in https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fpull\u002F3977.\n\n### Impact\nIncorrect values can be logged which may result in unexpected behavior in client-side applications relying on these logs.\n","2024-04-25T19:53:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":18,"attackComplexity":17,"availabilityImpact":18,"privilegesRequired":18,"confidentialityImpact":18},"UNCHANGED","3.1",5.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","LOW","NONE",true,[21],"CWE-20",[23,24],"cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*","cpe:2.3:a:vyper:vyper:*:*:*:*:*:*:*:*",[26,27],"Vyperlang Vyper","Vyper Vyper",[29,30,31,32],"https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fsecurity\u002Fadvisories\u002FGHSA-xchq-w5r3-4wg3","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-32645","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fvyper\u002FPYSEC-2024-206.yaml","https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper",0.47,0.00455,0.38587,false,null,{"timestamp":39,"automatable":40,"tech_impact":41,"exploitation":42,"cisa_decision":43,"cisa_remediation_timeline":47},"2024-07-03T17:10:02.463026Z","yes","partial","poc",{"vector":44,"decision":45,"priority":46},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T13:37:59.370502\u002F","attend","medium","14D",[49],{"name":50,"source":51,"tactics":52,"technique_id":54},"Exploit Public-Facing Application","attack_vector",[53],"initial-access","T1190",[]]