CVE-2021-3177

CRITICAL9.8EPSS 0.07%

python2.7 - security update

發布日:2021/1/19修改日:2025/12/3

也稱為:ALPINE-CVE-2021-3177

描述

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

受影響套件(7)

Alpine/python3from 0, < 3.7.7-r2
Bitnami/libpythonfrom 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
Bitnami/pythonfrom 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
Bitnami/python-minfrom 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
Debian/python2.7from 0, < 2.7.13-2+deb9u6
Debian/python2.7from 0, < 2.7.18-2
Debian/python3.9from 0, < 3.9.1-3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

描述

受影響套件(7)

CVSS 分數

參考連結(31)