CVE-2021-3177

Description

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

How to fix CVE-2021-3177

To remediate CVE-2021-3177, upgrade the affected package to a fixed version below.

—upgrade to 3.7.7-r2 or later
—upgrade to 3.6.13 or later
—upgrade to 3.6.13 or later
—upgrade to 3.6.13 or later
—upgrade to 2.7.13-2+deb9u6 or later
—upgrade to 2.7.18-2 or later
—upgrade to 3.9.1-3 or later

Is CVE-2021-3177 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

from 0, < 3.7.7-r2
from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
from 0, < 2.7.13-2+deb9u6
from 0, < 2.7.18-2
from 0, < 3.9.1-3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H