Kritik CVSS 9.8 PoC var

CVE-2021-3177: Python: arabellek taşması

Yayın: 19 Ocak 2021 09:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %24,00 (yüzdelik 98)
CWE: CWE-120
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	3.6.0	3.6.12	—
python-python	3.7.0	3.7.9	—
python-python	3.8.0	3.8.7	—
python-python	3.9.0	3.9.1	—
fedoraproject-fedora	32	32	—
fedoraproject-fedora	33	33	—
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—
netapp-ontap-select-deploy-administration-utility	—	—	—
debian-debian-linux	9.0	9.0	—
oracle-communications-cloud-native-core-network-function-cloud-native-environment	22.2.0	22.2.0	—
oracle-communications-offline-mediation-controller	12.0.0.3.0	12.0.0.3.0	—
oracle-communications-pricing-design-center	12.0.0.3.0	12.0.0.3.0	—
oracle-enterprise-manager-ops-center	12.4.0.0	12.4.0.0	—
oracle-zfs-storage-appliance-kit	8.8	8.8	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları