CVE-2021-3177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3177
Aliases
Downstream
Related
Published
2021-01-19T06:15:12.967Z
Modified
2026-03-10T23:34:46.386123Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs because sprintf is used unsafely.

References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12
Last affected
c0a9afe2ac1820409e6173bd1893ebee2cf50270
Introduced
1bf9cc509326bc42cd8cb1650eb9bf64550d817e
Last affected
13c94747c74437e594b7fc242ff7da668e81887c
Introduced
fa919fdf2583bdfead1df00e842f24f30b2a34bf
Last affected
6503f05dd59e26a9986bdea097b3da9b3546f45b
Introduced
9cf6752276e6fcfd0c23fdb064ad27f448aaaf75
Last affected
1e5d33e9b9b8631b36f061103a30208b206fd03a
Database specific 
{
    "versions": [
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "3.6.12"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "last_affected": "3.7.9"
        },
        {
            "introduced": "3.8.0"
        },
        {
            "last_affected": "3.8.7"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.1"
        }
    ]
}

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "22.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0.0.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0.0.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.4.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3177.json"