NetSight
IP …
critical9.8

CVE-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications tha…

Impact

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected products

VendorProductAffected versions
PythonPython
from 3.6.0 through 3.6.12
from 3.7.0 through 3.7.9
from 3.8.0 through 3.8.7
from 3.9.0 through 3.9.1
FedoraprojectFedora
Versions 32, 33
NetappActive Iq Unified Manager
All versions
NetappOntap Select Deploy Administration Utility
All versions
DebianDebian Linux
Version 9.0
OracleCommunications Cloud Native Core Network Function Cloud Native Environment
Version 22.2.0
OracleCommunications Offline Mediation Controller
Version 12.0.0.3.0
OracleCommunications Pricing Design Center
Version 12.0.0.3.0
OracleEnterprise Manager Ops Center
Version 12.4.0.0
OracleZfs Storage Appliance Kit
Version 8.8

Weakness classification

CWE-120

References