Change:
in buildPythonPackage rec { pname = "vyper"; <del> version = "0.3.1"; </del> <ins> version = "0.3.3"; </ins> format = "setuptools"; <del> disabled = pythonOlder "3.7" || pythonAtLeast "3.10"; </del> <ins> disabled = pythonOlder "3.7"; </ins> src = fetchPypi { inherit pname version; <del> sha256 = "sha256-fXug5v3zstz19uexMWokHBVsfcl2ZCdIOIXKeLVyh/Q="; </del> <ins> sha256 = "sha256-BAnNj27B1HAb9VVDA69bFGbQjeOpl0g5EB2juajqBAw="; </ins> }; nativeBuildInputs = [ <ins> # Git is used in setup.py to compute version information during building # ever since https://github.com/vyperlang/vyper/pull/2816 git </ins> pythonRelaxDepsHook pytest-runner setuptools-scm

Discussion:
, CVSSv3=9.8 (nixos-unstable) CVSSv3=9.8 (nixos-unstable) Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue. Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of is not validated to fall within the bounds of . This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue. Scanned versions: nixos-unstable: . Cc
See also:

, CVSSv3=9.8 (nixos-21.11) CVSSv3=9.8 (nixos-21.11) Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue. Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of is not validated to fall within the bounds of . This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue. Scanned versions: nixos-21.11: . Cc
See also:

<!-- Note that these are hard requirements --<!-- You can use the "Go to file" functionality on GitHub to find the package Then you can go to the history for this package Find the latest "packagename: oldversion -newversion" commit The "newversion" is the current version of the package --- <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- name: <!-- The current version can be found easily with the same process as above for checking the master branch If an open PR is present for the package, take this version as the current one and link to the PR --current version: desired version: <!-- Search your package here: If no maintainer is listed for your package, tag the person that last updated the package --maintainers: Please tag this issue in your PR.

, CVSSv3=7.5 (nixos-unstable) Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds. Scanned versions: nixos-unstable: . Cc

, CVSSv3=7.5 (nixos-21.11) Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds. Scanned versions: nixos-21.11: . Cc