CVE-2021-3177critical
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
References
https://bugs.python.org/issue42938
https://github.com/python/cpython/pull/24239
https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html
https://security.gentoo.org/glsa/202101-18
https://news.ycombinator.com/item?id=26185005
https://lists.apache.org/thread.html/[email protected]%3Cdev.mina.apache.org%3E
https://security.netapp.com/advisory/ntap-20210226-0003/
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
Details
Source: MITRE
Published: 2021-01-19
Updated: 2021-07-20
Type: CWE-120
Risk Information
CVSS v2
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3
Base Score: 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from 3.6.0 to 3.6.12 (inclusive)
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from 3.7.0 to 3.7.9 (inclusive)
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from 3.8.0 to 3.8.7 (inclusive)
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from 3.9.0 to 3.9.1 (inclusive)
Configuration 2
OR
Configuration 3
OR
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 151340 | EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2021-2096) | Nessus | Huawei Local Security Checks | critical |
| 151221 | EulerOS Virtualization 3.0.6.6 : python (EulerOS-SA-2021-2028) | Nessus | Huawei Local Security Checks | critical |
| 151178 | EulerOS Virtualization for ARM 64 3.0.6.0 : python3 (EulerOS-SA-2021-2007) | Nessus | Huawei Local Security Checks | critical |
| 150207 | EulerOS 2.0 SP9 : python3 (EulerOS-SA-2021-1957) | Nessus | Huawei Local Security Checks | critical |
| 150184 | EulerOS 2.0 SP9 : python3 (EulerOS-SA-2021-1936) | Nessus | Huawei Local Security Checks | critical |
| 150032 | CentOS 8 : python38:3.8 (CESA-2021:1879) | Nessus | CentOS Local Security Checks | critical |
| 149959 | Oracle Linux 8 : python3 (ELSA-2021-1633) | Nessus | Oracle Linux Local Security Checks | critical |
| 149749 | CentOS 8 : python27:2.7 (CESA-2021:1761) | Nessus | CentOS Local Security Checks | critical |
| 149729 | CentOS 8 : python3 (CESA-2021:1633) | Nessus | CentOS Local Security Checks | critical |
| 149712 | RHEL 8 : python3 (RHSA-2021:1633) | Nessus | Red Hat Local Security Checks | critical |
| 149710 | RHEL 8 : python27:2.7 (RHSA-2021:1761) | Nessus | Red Hat Local Security Checks | critical |
| 149708 | RHEL 8 : python38:3.8 (RHSA-2021:1879) | Nessus | Red Hat Local Security Checks | critical |
| 149608 | EulerOS 2.0 SP5 : python (EulerOS-SA-2021-1911) | Nessus | Huawei Local Security Checks | critical |
| 149544 | EulerOS 2.0 SP8 : python3 (EulerOS-SA-2021-1886) | Nessus | Huawei Local Security Checks | critical |
| 149188 | EulerOS 2.0 SP3 : python (EulerOS-SA-2021-1835) | Nessus | Huawei Local Security Checks | critical |
| 148596 | EulerOS Virtualization 2.9.1 : python3 (EulerOS-SA-2021-1722) | Nessus | Huawei Local Security Checks | critical |
| 148579 | EulerOS Virtualization 2.9.0 : python3 (EulerOS-SA-2021-1747) | Nessus | Huawei Local Security Checks | critical |
| 148348 | Photon OS 4.0: Python3 PHSA-2021-4.0-0007 | Nessus | PhotonOS Local Security Checks | critical |
| 148322 | Debian DLA-2619-1 : python3.5 security update | Nessus | Debian Local Security Checks | critical |
| 148008 | Ubuntu 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4754-3) | Nessus | Ubuntu Local Security Checks | critical |
| 147997 | Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 : Python vulnerabilities (USN-4754-1) | Nessus | Ubuntu Local Security Checks | critical |
| 147995 | Ubuntu 16.04 LTS / 18.04 LTS : Python 2.7 vulnerability (USN-4754-4) | Nessus | Ubuntu Local Security Checks | critical |
| 147967 | Oracle Linux 8 : python38 (ELSA-2021-9130) | Nessus | Oracle Linux Local Security Checks | critical |
| 147966 | Oracle Linux 8 : python2 (ELSA-2021-9128) | Nessus | Oracle Linux Local Security Checks | critical |
| 147965 | Oracle Linux 8 : python36 (ELSA-2021-9129) | Nessus | Oracle Linux Local Security Checks | critical |
| 147811 | Oracle Linux 7 : python (ELSA-2021-9107) | Nessus | Oracle Linux Local Security Checks | critical |
| 147642 | Oracle Linux 8 : python3 (ELSA-2021-9100) | Nessus | Oracle Linux Local Security Checks | critical |
| 147621 | Oracle Linux 7 : python3 (ELSA-2021-9101) | Nessus | Oracle Linux Local Security Checks | critical |
| 146886 | Fedora 32 : python37 (2021-907f3bacae) | Nessus | Fedora Local Security Checks | critical |
| 146851 | openSUSE Security Update : python3 (openSUSE-2021-331) | Nessus | SuSE Local Security Checks | critical |
| 146841 | Fedora 32 : python36 (2021-3352c1c802) | Nessus | Fedora Local Security Checks | critical |
| 146819 | Amazon Linux AMI : python27, python36, python38 (ALAS-2021-1484) | Nessus | Amazon Linux Local Security Checks | critical |
| 146749 | Fedora 33 : python3.7 (2021-f4fd9372c7) | Nessus | Fedora Local Security Checks | critical |
| 146737 | Fedora 33 : python3.6 (2021-7547ad987f) | Nessus | Fedora Local Security Checks | critical |
| 146729 | SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0529-1) | Nessus | SuSE Local Security Checks | critical |
| 146622 | Amazon Linux 2 : python, python3 (ALAS-2021-1611) | Nessus | Amazon Linux Local Security Checks | critical |
| 146518 | openSUSE Security Update : python (openSUSE-2021-270) | Nessus | SuSE Local Security Checks | critical |
| 146515 | Fedora 32 : python3.10 (2021-d5cde50865) | Nessus | Fedora Local Security Checks | critical |
| 146484 | Photon OS 2.0: Python3 PHSA-2021-2.0-0317 | Nessus | PhotonOS Local Security Checks | critical |
| 146463 | SUSE SLES12 Security Update : python (SUSE-SU-2021:0432-1) | Nessus | SuSE Local Security Checks | critical |
| 146440 | Photon OS 3.0: Python3 PHSA-2021-3.0-0192 | Nessus | PhotonOS Local Security Checks | critical |
| 146412 | Fedora 32 : python27 (2021-17668e344a) | Nessus | Fedora Local Security Checks | critical |
| 146400 | Fedora 33 : python2.7 (2021-66547ff92d) | Nessus | Fedora Local Security Checks | critical |
| 146395 | SUSE SLES12 Security Update : python36 (SUSE-SU-2021:0428-1) | Nessus | SuSE Local Security Checks | critical |
| 146367 | SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2021:0355-1) | Nessus | SuSE Local Security Checks | critical |
| 146296 | Fedora 32 : python3 (2021-076a2dccba) | Nessus | Fedora Local Security Checks | critical |
| 146292 | Fedora 33 : python3.10 (2021-851c6e4e2d) | Nessus | Fedora Local Security Checks | critical |
| 145760 | Fedora 32 : mingw-python3 (2021-42ba9feb47) | Nessus | Fedora Local Security Checks | critical |
| 145751 | Fedora 33 : mingw-python3 (2021-ced31f3f0c) | Nessus | Fedora Local Security Checks | critical |
| 145562 | Fedora 32 : python39 (2021-e3a5a74610) | Nessus | Fedora Local Security Checks | critical |
| 145534 | Python Buffer Overflow (CVE-2021-3177) | Nessus | Windows | critical |
| 145318 | Fedora 33 : python3.9 (2021-faf88b9499) | Nessus | Fedora Local Security Checks | critical |
| 145303 | GLSA-202101-18 : Python: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | critical |
| 145281 | Fedora 33 : python3.8 (2021-cc3ff94cfc) | Nessus | Fedora Local Security Checks | critical |