REDHAT-BUG-1918168: Buffer Overflow
Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input.
Reference:
https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1918168?
The severity of REDHAT-BUG-1918168 is critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-1918168?
To fix REDHAT-BUG-1918168, upgrade Python to version 3.9.2 or later.
What causes the vulnerability in REDHAT-BUG-1918168?
The vulnerability in REDHAT-BUG-1918168 is caused by a buffer overflow in the PyCArg_repr function when handling untrusted floating-point input.
Which versions of Python are affected by REDHAT-BUG-1918168?
REDHAT-BUG-1918168 affects Python versions 3.9.1 and earlier.
Can REDHAT-BUG-1918168 be exploited remotely?
Yes, REDHAT-BUG-1918168 can be exploited remotely if the application accepts untrusted floating-point numbers as input.