CVE-2021-3177: Buffer Overflow
First published: Tue Jan 19 2021(Updated: )
Python is vulnerable to a buffer overflow, caused by improper bounds checking by the PyCArg_repr function in _ctypes/callproc.c. By sending specially-crafted arguments to c_double.from_param, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/python | <0:2.7.5-92.el7_9 | 0:2.7.5-92.el7_9 |
| redhat/python3 | <0:3.6.8-37.el8 | 0:3.6.8-37.el8 |
| redhat/python27-babel | <0:0.9.6-10.el7 | 0:0.9.6-10.el7 |
| redhat/python27-python | <0:2.7.18-3.el7 | 0:2.7.18-3.el7 |
| redhat/python27-python-jinja2 | <0:2.6-16.el7 | 0:2.6-16.el7 |
| redhat/python27-python-pygments | <0:1.5-5.el7 | 0:1.5-5.el7 |
| redhat/rh-python38-babel | <0:2.7.0-12.el7 | 0:2.7.0-12.el7 |
| redhat/rh-python38-python | <0:3.8.11-2.el7 | 0:3.8.11-2.el7 |
| redhat/rh-python38-python-cryptography | <0:2.8-5.el7 | 0:2.8-5.el7 |
| redhat/rh-python38-python-jinja2 | <0:2.10.3-6.el7 | 0:2.10.3-6.el7 |
| redhat/rh-python38-python-lxml | <0:4.4.1-7.el7 | 0:4.4.1-7.el7 |
| redhat/rh-python38-python-pip | <0:19.3.1-2.el7 | 0:19.3.1-2.el7 |
| redhat/rh-python38-python-urllib3 | <0:1.25.7-7.el7 | 0:1.25.7-7.el7 |
| debian/python2.7 | <=2.7.16-2+deb10u1 | 2.7.16-2+deb10u4 2.7.18-8+deb11u1 |
| debian/python3.7 | 3.7.3-2+deb10u3 3.7.3-2+deb10u7 | |
| debian/python3.9 | 3.9.2-1 | |
| ubuntu/python2.7 | <2.7.17-1~18.04ubuntu1.6 | 2.7.17-1~18.04ubuntu1.6 |
| ubuntu/python2.7 | <2.7.18-1~20.04.1 | 2.7.18-1~20.04.1 |
| ubuntu/python2.7 | <2.7.6-8ubuntu0.6+ | 2.7.6-8ubuntu0.6+ |
| ubuntu/python2.7 | <2.7.12-1ubuntu0~16.04.18 | 2.7.12-1ubuntu0~16.04.18 |
| ubuntu/python3.4 | <3.4.3-1ubuntu1~14.04.7+ | 3.4.3-1ubuntu1~14.04.7+ |
| ubuntu/python3.5 | <3.5.2-2ubuntu0~16.04.13 | 3.5.2-2ubuntu0~16.04.13 |
| ubuntu/python3.6 | <3.6.9-1~18.04ubuntu1.4 | 3.6.9-1~18.04ubuntu1.4 |
| ubuntu/python3.7 | <3.7.5-2~18.04.4 | 3.7.5-2~18.04.4 |
| ubuntu/python3.8 | <3.8.0-3~18.04.1 | 3.8.0-3~18.04.1 |
| ubuntu/python3.8 | <3.8.5-1~20.04.2 | 3.8.5-1~20.04.2 |
| ubuntu/python3.8 | <3.8.6-1ubuntu0.2 | 3.8.6-1ubuntu0.2 |
| ubuntu/python3.9 | <3.9.5-3~20.04.1 | 3.9.5-3~20.04.1 |
| ubuntu/python3.9 | <3.9.5-3~20.10.1 | 3.9.5-3~20.10.1 |
| ubuntu/python3.9 | <3.9.1-3 | 3.9.1-3 |
| Python Python | >=3.6.0<=3.6.12 | |
| Python Python | >=3.7.0<=3.7.9 | |
| Python Python | >=3.8.0<=3.8.7 | |
| Python Python | >=3.9.0<=3.9.1 | |
| Fedoraproject Fedora | =32 | |
| Fedoraproject Fedora | =33 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| NetApp ONTAP Select Deploy administration utility | ||
| Debian Debian Linux | =9.0 | |
| Oracle Communications Cloud Native Core Network Function Cloud Native Environment | =22.2.0 | |
| Oracle Communications Offline Mediation Controller | =12.0.0.3.0 | |
| Oracle Communications Pricing Design Center | =12.0.0.3.0 | |
| Oracle Enterprise Manager Ops Center | =12.4.0.0 | |
| Oracle ZFS Storage Appliance Kit | =8.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-3177 https://nvd.nist.gov/vuln/detail/CVE-2021-3177
- https://bugzilla.redhat.com/show_bug.cgi?id=1918168
- https://access.redhat.com/errata/RHSA-2022:5235
- https://access.redhat.com/errata/RHSA-2021:1633
- https://access.redhat.com/errata/RHSA-2021:1761
- https://access.redhat.com/errata/RHSA-2021:1879
- https://access.redhat.com/errata/RHSA-2021:3252
- https://access.redhat.com/errata/RHSA-2021:3254
- https://access.redhat.com/security/cve/cve-2021-3177
- https://exchange.xforce.ibmcloud.com/vulnerabilities/195244
- https://www.ibm.com/support/pages/node/6491661 (Advisory)
- https://bugs.python.org/issue42938
- https://github.com/python/cpython/pull/24239
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
- https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/
- https://news.ycombinator.com/item?id=26185005
- https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html
- https://security.gentoo.org/glsa/202101-18
- https://security.netapp.com/advisory/ntap-20210226-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://launchpad.net/bugs/cve/CVE-2021-3177
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/
- https://github.com/python/cpython/commit/916610ef90a0d0761f08747f7b0905541f0977c7
- https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f7799a932
- https://github.com/python/cpython/commit/ece5dfd403dac211f8d3c72701fe7ba7b7aa5b5f
- https://github.com/python/cpython/commit/d9b8f138b7df3b455b54653ca59f491b4840d6fa
- https://github.com/python/cpython/commit/34df10a9a16b38d54421eeeaf73ec89828563be7
- https://security-tracker.debian.org/tracker/CVE-2021-3177
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918175
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918177
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918176
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918169
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918170
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918172
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918173
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918174
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918168#c3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918659
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918660
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918661
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918662
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918663
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918665
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918666
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918668
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918669
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918168#c4
- https://bugs.python.org/issue42988
- https://ubuntu.com/security/notices/USN-4754-1
- https://ubuntu.com/security/notices/USN-4754-2 (regression in python2.7)
- https://ubuntu.com/security/notices/USN-4754-4
- https://ubuntu.com/security/notices/USN-4754-3
- https://ubuntu.com/security/notices/USN-4754-5
- https://www.cve.org/CVERecord?id=CVE-2021-3177
- https://nvd.nist.gov/vuln/detail/CVE-2021-3177
- https://ubuntu.com/security/CVE-2021-3177
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-3177?
CVE-2021-3177 is a vulnerability in Python that allows an attacker to overflow a buffer on the stack and potentially execute arbitrary code.
What is the severity of CVE-2021-3177?
The severity of CVE-2021-3177 is critical with a CVSS score of 9.8.
Which versions of Python are affected by CVE-2021-3177?
Python versions 2.7.0 to 2.7.18, 3.6.0 to 3.6.12, 3.7.0 to 3.7.9, 3.8.0 to 3.8.7, and 3.9.0 to 3.9.1 are affected by CVE-2021-3177.
How can I fix CVE-2021-3177?
To fix CVE-2021-3177, upgrade to Python versions 2.7.19, 3.6.13, 3.7.10, 3.8.8, or 3.9.2 or later.
Are there any references for CVE-2021-3177?
Yes, you can find more information about CVE-2021-3177 at the following references: [Link 1](https://bugs.python.org/issue42938), [Link 2](https://github.com/python/cpython/pull/24239), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918175).
- collector/redhat-cve
- collector/ibm-support
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3177
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/remedy
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/debian
- package-manager/ubuntu
- vendor/python
- canonical/python python
- version/python python/3.6.0
- version/python python/3.6.12
- version/python python/3.7.0
- version/python python/3.7.9
- version/python python/3.8.0
- version/python python/3.8.7
- version/python python/3.9.0
- version/python python/3.9.1
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/32
- version/fedoraproject fedora/33
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp ontap select deploy administration utility
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/oracle
- canonical/oracle communications cloud native core network function cloud native environment
- version/oracle communications cloud native core network function cloud native environment/22.2.0
- canonical/oracle communications offline mediation controller
- version/oracle communications offline mediation controller/12.0.0.3.0
- canonical/oracle communications pricing design center
- version/oracle communications pricing design center/12.0.0.3.0
- canonical/oracle enterprise manager ops center
- version/oracle enterprise manager ops center/12.4.0.0
- canonical/oracle zfs storage appliance kit
- version/oracle zfs storage appliance kit/8.8