CVE-2021-3177 — פרטי פגיעות

תיאור (מקור, אנגלית)

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

מדדים

CVSS 3.1: 9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — סבירות ניצול: 24% (אחוזון 100) נכון ל-28/10/2026
CWE: CWE-120

מוצרים מושפעים

python: python; fedoraproject: fedora; netapp: active iq unified manager; netapp: ontap select deploy administration utility; debian: debian linux; oracle: communications cloud native core network function cloud native environment; oracle: communications offline mediation controller; oracle: communications pricing design center; oracle: enterprise manager ops center; oracle: zfs storage appliance kit

קישורים

https://bugs.python.org/issue42938 ExploitIssue TrackingPatchVendor Advisory
https://bugs.python.org/issue42938 ExploitIssue TrackingPatchVendor Advisory
https://github.com/python/cpython/pull/24239 PatchThird Party Advisory
https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr‮… PatchThird Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
https://github.com/python/cpython/pull/24239 PatchThird Party Advisory
https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr‮… PatchThird Party Advisory

תיאור (מקור, אנגלית)

מדדים

מוצרים מושפעים

קישורים

נגישות