CVE-2021-3177

Published: Jan 19, 2021Modified: Dec 18, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected (15)

Products: Python: Python · Fedoraproject: Fedora · Netapp: Active Iq Unified Manager, Ontap Select Deploy Administration Utility · +2 more

Show all products

Python: Python · Fedoraproject: Fedora · Netapp: Active Iq Unified Manager, Ontap Select Deploy Administration Utility · Debian: Debian Linux · Oracle: Communications Cloud Native Core Network Function Cloud Native Environment, Communications Offline Mediation Controller, Communications Pricing Design Center, Enterprise Manager Ops Center, Zfs Storage Appliance Kit

1 product

1 product

2 products

Active Iq Unified Manager

Ontap Select Deploy Administration Utility

Debian

1 product

Debian Linux

Oracle

5 products

Communications Cloud Native Core Network Function Cloud Native Environment

Communications Offline Mediation Controller

Communications Pricing Design Center

Enterprise Manager Ops Center

Zfs Storage Appliance Kit

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Python Python	From 3.6.0 to 3.6.12
Python Python	From 3.7.0 to 3.7.9
Python Python	From 3.8.0 to 3.8.7
Python Python	From 3.9.0 to 3.9.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Ontap Select Deploy Administration Utility	All versions

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 22.2.0
Oracle Communications Offline Mediation Controller	Version 12.0.0.3.0
Oracle Communications Pricing Design Center	Version 12.0.0.3.0
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Zfs Storage Appliance Kit	Version 8.8

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (56)

https://bugs.python.org/issue42938

Source: cve@mitre.org

ExploitIssue TrackingPatchVendor Advisory

https://github.com/python/cpython/pull/24239

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/

Source: cve@mitre.org

https://news.ycombinator.com/item?id=26185005

Source: cve@mitre.org

Third Party Advisory

https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html

Source: cve@mitre.org

PatchThird Party Advisory

https://security.gentoo.org/glsa/202101-18

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210226-0003/

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://bugs.python.org/issue42938