CVE-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs because sprintf is used unsafely.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "22.2.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.2.0:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "12.0.0.3.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "12.0.0.3.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "12.4.0.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "8.8"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "9.0"
                }
            ],
            "cpe": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "32"
                }
            ],
            "cpe": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "33"
                }
            ],
            "cpe": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*"
        }
    ]
}

References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type

GIT

Repo

https://github.com/python/cpython

Events

Introduced

5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12

Last affected

c0a9afe2ac1820409e6173bd1893ebee2cf50270

Introduced

1bf9cc509326bc42cd8cb1650eb9bf64550d817e

Last affected

13c94747c74437e594b7fc242ff7da668e81887c

Introduced

fa919fdf2583bdfead1df00e842f24f30b2a34bf

Last affected

6503f05dd59e26a9986bdea097b3da9b3546f45b

Introduced

9cf6752276e6fcfd0c23fdb064ad27f448aaaf75

Last affected

1e5d33e9b9b8631b36f061103a30208b206fd03a

Database specific

{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "3.6.12"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "last_affected": "3.7.9"
        },
        {
            "introduced": "3.8.0"
        },
        {
            "last_affected": "3.8.7"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.1"
        }
    ],
    "cpe": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3177.json"