CVE-2021-3177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3177
Aliases
Downstream
Related
Published
2021-01-19T06:15:12.967Z
Modified
2026-04-02T06:50:52.848026Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs because sprintf is used unsafely.

References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12
Last affected
c0a9afe2ac1820409e6173bd1893ebee2cf50270
Introduced
1bf9cc509326bc42cd8cb1650eb9bf64550d817e
Last affected
13c94747c74437e594b7fc242ff7da668e81887c
Introduced
fa919fdf2583bdfead1df00e842f24f30b2a34bf
Last affected
6503f05dd59e26a9986bdea097b3da9b3546f45b
Introduced
9cf6752276e6fcfd0c23fdb064ad27f448aaaf75
Last affected
1e5d33e9b9b8631b36f061103a30208b206fd03a
Database specific 
{
    "versions": [
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "3.6.12"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "last_affected": "3.7.9"
        },
        {
            "introduced": "3.8.0"
        },
        {
            "last_affected": "3.8.7"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.1"
        }
    ]
}

Affected versions

v3.*
v3.10.0
v3.10.0a1
v3.10.0a2
v3.10.0a3
v3.10.0a4
v3.10.0a5
v3.10.0a6
v3.10.0a7
v3.10.0b1
v3.10.0b2
v3.10.0b3
v3.10.0b4
v3.10.0rc1
v3.10.0rc2
v3.10.1
v3.10.10
v3.10.11
v3.10.12
v3.10.13
v3.10.14
v3.10.15
v3.10.16
v3.10.17
v3.10.18
v3.10.19
v3.10.2
v3.10.20
v3.10.3
v3.10.4
v3.10.5
v3.10.6
v3.10.7
v3.10.8
v3.10.9
v3.11.0
v3.11.0a1
v3.11.0a2
v3.11.0a3
v3.11.0a4
v3.11.0a5
v3.11.0a6
v3.11.0a7
v3.11.0b1
v3.11.0b2
v3.11.0b3
v3.11.0b4
v3.11.0b5
v3.11.0rc1
v3.11.0rc2
v3.11.1
v3.11.10
v3.11.11
v3.11.12
v3.11.13
v3.11.14
v3.11.15
v3.11.2
v3.11.3
v3.11.4
v3.11.5
v3.11.6
v3.11.7
v3.11.8
v3.11.9
v3.12.0
v3.12.0a1
v3.12.0a2
v3.12.0a3
v3.12.0a4
v3.12.0a5
v3.12.0a6
v3.12.0a7
v3.12.0b1
v3.12.0b2
v3.12.0b3
v3.12.0b4
v3.12.0rc1
v3.12.0rc2
v3.12.0rc3
v3.12.1
v3.12.10
v3.12.11
v3.12.12
v3.12.13
v3.12.2
v3.12.3
v3.12.4
v3.12.5
v3.12.6
v3.12.7
v3.12.8
v3.12.9
v3.13.0
v3.13.0a1
v3.13.0a2
v3.13.0a3
v3.13.0a4
v3.13.0a5
v3.13.0a6
v3.13.0b1
v3.13.0b2
v3.13.0b3
v3.13.0b4
v3.13.0rc1
v3.13.0rc2
v3.13.0rc3
v3.13.1
v3.13.10
v3.13.11
v3.13.12
v3.13.2
v3.13.3
v3.13.4
v3.13.5
v3.13.6
v3.13.7
v3.13.8
v3.13.9
v3.14.0
v3.14.0a1
v3.14.0a2
v3.14.0a3
v3.14.0a4
v3.14.0a5
v3.14.0a6
v3.14.0a7
v3.14.0b1
v3.14.0b2
v3.14.0b3
v3.14.0b4
v3.14.0rc1
v3.14.0rc2
v3.14.0rc3
v3.14.1
v3.14.2
v3.14.3
v3.15.0a1
v3.15.0a2
v3.15.0a3
v3.15.0a4
v3.15.0a5
v3.15.0a6
v3.15.0a7
v3.6.0
v3.6.1
v3.6.10
v3.6.10rc1
v3.6.11
v3.6.11rc1
v3.6.12
v3.6.1rc1
v3.6.2
v3.6.2rc1
v3.6.2rc2
v3.6.3
v3.6.3rc1
v3.6.4
v3.6.4rc1
v3.6.5
v3.6.5rc1
v3.6.6
v3.6.6rc1
v3.6.7
v3.6.7rc1
v3.6.7rc2
v3.6.8
v3.6.8rc1
v3.6.9
v3.6.9rc1
v3.7.0
v3.7.0a1
v3.7.0a2
v3.7.0a3
v3.7.0a4
v3.7.0b1
v3.7.0b2
v3.7.0b3
v3.7.0b4
v3.7.0b5
v3.7.0rc1
v3.7.1
v3.7.1rc1
v3.7.1rc2
v3.7.2
v3.7.2rc1
v3.7.3
v3.7.3rc1
v3.7.4
v3.7.4rc1
v3.7.4rc2
v3.7.5
v3.7.5rc1
v3.7.6
v3.7.6rc1
v3.7.7
v3.7.7rc1
v3.7.8
v3.7.8rc1
v3.7.9
v3.8.0
v3.8.0a1
v3.8.0a2
v3.8.0a3
v3.8.0a4
v3.8.0b1
v3.8.0b2
v3.8.0b3
v3.8.0b4
v3.8.0rc1
v3.8.1
v3.8.1rc1
v3.8.2
v3.8.2rc1
v3.8.2rc2
v3.8.3
v3.8.3rc1
v3.8.4
v3.8.4rc1
v3.8.5
v3.8.6
v3.8.6rc1
v3.8.7
v3.8.7rc1
v3.9.0
v3.9.0a1
v3.9.0a2
v3.9.0a3
v3.9.0a4
v3.9.0a5
v3.9.0a6
v3.9.0b1
v3.9.0b2
v3.9.0b3
v3.9.0b4
v3.9.0b5
v3.9.0rc1
v3.9.0rc2
v3.9.1
v3.9.1rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3177.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "22.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0.0.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0.0.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.4.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8"
            }
        ]
    }
]