CVE-2021-3177
Summary
| CVE | CVE-2021-3177 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-01-19 06:15:12 UTC |
| Updated | 2026-10-14 10:17:38 UTC |
| Description | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-120 | n/a | CWE-120 CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 32 | All | All | All |
| Operating System | Fedoraproject | Fedora | 33 | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Ontap Select Deploy Administration Utility | - | All | All | All |
| Application | Oracle | Communications Cloud Native Core Network Function Cloud Native Environment | 22.2.0 | All | All | All |
| Application | Oracle | Communications Offline Mediation Controller | 12.0.0.3.0 | All | All | All |
| Application | Oracle | Communications Pricing Design Center | 12.0.0.3.0 | All | All | All |
| Application | Oracle | Enterprise Manager Ops Center | 12.4.0.0 | All | All | All |
| Application | Oracle | Zfs Storage Appliance Kit | 8.8 | All | All | All |
| Application | Python | Python | All | All | All | All |
| Application | Python | Python | All | All | All | All |
| Application | Python | Python | All | All | All | All |
| Application | Python | Python | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | N/a | affected n/a | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/html/ssa-398330.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| [SECURITY] [DLA 2919-1] python2.7 security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 32 Update: python3.10-3.10.0~a5-1.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Python 3.x: RCE in Python applications that accept floats as untrusted input | Hacker News | af854a3a-2127-422b-91ae-364da2661108 | news.ycombinator.com | Third Party Advisory |
| Oracle Critical Patch Update Advisory - October 2021 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| Issue 42938: [security] ctypes double representation BoF - Python tracker | af854a3a-2127-422b-91ae-364da2661108 | bugs.python.org | Exploit, Issue Tracking, Patch, Vendor Advisory |
| [SECURITY] Fedora 32 Update: python39-3.9.1-2.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| CVE-2021-3177 Python Vulnerability in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | Third Party Advisory |
| [SECURITY] Fedora 33 Update: python3.7-3.7.10-1.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Oracle Critical Patch Update Advisory - July 2021 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| [SECURITY] Fedora 32 Update: python36-3.6.13-1.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python27-2.7.18-8.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.9-3.9.1-2.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Python: Multiple vulnerabilities (GLSA 202101-18) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| [SECURITY] Fedora 33 Update: python3.6-3.6.13-1.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Oracle Critical Patch Update Advisory - January 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| [SECURITY] Fedora 32 Update: python3-3.8.7-2.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. by benjaminp · Pull Request #24239 · python/cpython · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Third Party Advisory |
| [SECURITY] Fedora 33 Update: python2.7-2.7.18-8.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python37-3.7.10-1.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: mingw-python3-3.8.3-8.fc32 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: mingw-python3-3.9.1-2.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.8-3.8.7-2.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685a... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| [SECURITY] Fedora 33 Update: python3.10-3.10.0~a5-1.fc33 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| ctypes: Buffer overflow in PyCArg_repr — Python Security 0.0 documentation | af854a3a-2127-422b-91ae-364da2661108 | python-security.readthedocs.io | Patch, Third Party Advisory |
| [SECURITY] [DLA 3432-1] python2.7 security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| [SECURITY] [DLA 2619-1] python3.5 security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 32 Update: python3-3.8.7-2.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python27-2.7.18-8.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python36-3.6.13-1.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: mingw-python3-3.8.3-8.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python2.7-2.7.18-8.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.6-3.6.13-1.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.10-3.10.0~a5-1.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python37-3.7.10-1.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.8-3.8.7-2.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: mingw-python3-3.9.1-2.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python3.10-3.10.0~a5-1.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: python39-3.9.1-2.fc32 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.7-3.7.10-1.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 33 Update: python3.9-3.9.1-2.fc33 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159129 Oracle Enterprise Linux Security Update for python2 (ELSA-2021-9128)
- 159130 Oracle Enterprise Linux Security Update for python36 (ELSA-2021-9129)
- 159131 Oracle Enterprise Linux Security Update for python38 (ELSA-2021-9130)
- 159200 Oracle Enterprise Linux Security Update for python3 (ELSA-2021-1633)
- 159342 Oracle Enterprise Linux Security Update for python27:2.7 (ELSA-2021-1761)
- 159460 Oracle Enterprise Linux Security Update for python38:3.8 (ELSA-2021-1879)
- 159958 Oracle Enterprise Linux Security Update for python (ELSA-2022-5235)
- 178536 Debian Security Update for python3.5 (DLA 2619-1)
- 179069 Debian Security Update for python2.7 (DLA 2919-1)
- 179762 Debian Security Update for python3.7python2.7python3.9 (CVE-2021-3177)
- 181802 Debian Security Update for python2.7 (DLA 3432-1)
- 198293 Ubuntu Security Notification for Python2.7, Python3.7, Python3.8 Vulnerabilities (USN-4754-3)
- 239292 Red Hat Update for python38:3.8 (RHSA-2021:1879)
- 239307 Red Hat Update for python27:2.7 (RHSA-2021:1761)
- 239323 Red Hat Update for python3 (RHSA-2021:1633)
- 239580 Red Hat Update for rh-python38 (RHSA-2021:3254)
- 239582 Red Hat Update for python27 (RHSA-2021:3252)
- 240523 Red Hat Update for python (RHSA-2022:5235)
- 257179 CentOS Security Update for python (CESA-2022:5235)
- 281609 Fedora Security Update for python3.6 (FEDORA-2021-7fa9dc84d4)
- 352299 Amazon Linux Security Update for python26 python27: AL2012-2021-338
- 356245 Amazon Linux Security Advisory for python38 : ALASPYTHON3.8-2023-005
- 375419 Python3 Remote Code Execution Vulnerability
- 375537 Python Buffer Overflow/Web Cache Poisoning Vulnerability
- 376090 IBM Cognos Analytics Multiple Vulnerabilities (6491661)
- 377245 Alibaba Cloud Linux Security Update for python (ALINUX2-SA-2022:0032)
- 377387 Alibaba Cloud Linux Security Update for python3 (ALINUX3-SA-2021:0080)
- 377557 Alibaba Cloud Linux Security Update for python27:2.7 (ALINUX3-SA-2022:0112)
- 500594 Alpine Linux Security Update for python3
- 501480 Alpine Linux Security Update for python3
- 501773 Alpine Linux Security Update for python3
- 501907 Alpine Linux Security Update for python2
- 504344 Alpine Linux Security Update for python3
- 670241 EulerOS Security Update for python (EulerOS-SA-2021-1835)
- 670313 EulerOS Security Update for python (EulerOS-SA-2021-1911)
- 670338 EulerOS Security Update for python3 (EulerOS-SA-2021-1886)
- 670368 EulerOS Security Update for python3 (EulerOS-SA-2021-1957)
- 670389 EulerOS Security Update for python3 (EulerOS-SA-2021-1936)
- 670668 EulerOS Security Update for python (EulerOS-SA-2021-2427)
- 750349 OpenSUSE Security Update for python3 (openSUSE-SU-2021:0331-1)
- 750365 OpenSUSE Security Update for python (openSUSE-SU-2021:0270-1)
- 900033 CBL-Mariner Linux Security Update for python3 3.7.9
- 903008 Common Base Linux Mariner (CBL-Mariner) Security Update for python3 (3812)
- 904870 Common Base Linux Mariner (CBL-Mariner) Security Update for python2 (12412)
- 940187 AlmaLinux Security Update for python3 (ALSA-2021:1633)
- 940287 AlmaLinux Security Update for python38:3.8 (ALSA-2021:1879)
- 940311 AlmaLinux Security Update for python27:2.7 (ALSA-2021:1761)
- 960385 Rocky Linux Security Update for python38:3.8 (RLSA-2021:1879)
- 960420 Rocky Linux Security Update for python27:2.7 (RLSA-2021:1761)