Description

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Remediation

References

CVE-2021-3177

Related Vulnerabilities

Grafana Externally Controlled Reference to a Resource in Another Sphere Vulnerability (CVE-2021-41244)

WordPress Plugin The Events Calendar Security Bypass (3.11.2)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-29002)

OpenSSL Cryptographic Issues Vulnerability (CVE-2010-0742)

WordPress Other Vulnerability (CVE-2007-1599)

Severity

Critical

Classification

CVE-2021-3177 CWE-120 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities