CVE-2017-1000158

Description

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

How to fix CVE-2017-1000158

To remediate CVE-2017-1000158, upgrade the affected package to a fixed version below.

Alpine/python—upgrade to 2.7.14-r0 or later
—upgrade to 2.7.14-r0 or later
—upgrade to 2.6.8-1.1+deb7u1 or later
—upgrade to 2.7.13-4 or later
—upgrade to 2.7.3-6+deb7u4 or later
—upgrade to 2.7.9-2+deb8u2 or later
—upgrade to 3.4.2-1+deb8u1 or later
—upgrade to 3.5.3-1+deb9u1 or later

Is CVE-2017-1000158 being exploited?

Low — EPSS is 3.6%, meaning exploitation activity has not been observed at scale.

Affected packages (8)

from 0, < 2.7.14-r0
from 0, < 2.7.14-r0
from 0, < 2.6.8-1.1+deb7u1
from 0, < 2.7.13-4
from 0, < 2.7.3-6+deb7u4
from 0, < 2.7.9-2+deb8u2
from 0, < 3.4.2-1+deb8u1
from 0, < 3.5.3-1+deb9u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H