Detections
Analytics
SCA: security update for vyper (GHSA-6845-xw22-ffxv)
medium Tenable Self-Hosted Container Security Plugin ID 421493
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when
compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability
can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper
code). `sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the
issue shouldn't be possible to trigger when compiling the compiler-generated `IR`. This issue isn't
triggered during normal compilation of vyper code so the impact is low. At the time of publication there
is no patch available. (CVE-2024-24559)
See Also
Plugin Details
Severity: Medium
ID: 421493
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 3/28/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2024-24559
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 2/5/2024
Vulnerability Publication Date: 2/5/2024
Reference Information
CVE: CVE-2024-24559
cwe: CWE-327