REDHAT-BUG-1918168: Buffer Overflow
First published: Wed Jan 20 2021(Updated: )
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input. Reference: <a href="https://bugs.python.org/issue42938">https://bugs.python.org/issue42938</a> <a href="https://github.com/python/cpython/pull/24239">https://github.com/python/cpython/pull/24239</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Python Babel Localedata | <=3.9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.python.org/issue42938
- https://github.com/python/cpython/pull/24239
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918175
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918177
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918176
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918169
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918170
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918172
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918173
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918174
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918168#c3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918659
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918660
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918661
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918662
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918663
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918665
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918666
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918668
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918669
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918168#c4
- https://bugs.python.org/issue42988
- https://access.redhat.com/errata/RHSA-2021:1633
- https://access.redhat.com/security/cve/cve-2021-3177
- https://access.redhat.com/errata/RHSA-2021:1761
- https://access.redhat.com/errata/RHSA-2021:1879
- https://access.redhat.com/errata/RHSA-2021:3252
- https://access.redhat.com/errata/RHSA-2021:3254
- https://access.redhat.com/errata/RHSA-2022:5235
- https://bugzilla.redhat.com/show_bug.cgi?id=1918168
Frequently Asked Questions
What is the severity of REDHAT-BUG-1918168?
The severity of REDHAT-BUG-1918168 is critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-1918168?
To fix REDHAT-BUG-1918168, upgrade Python to version 3.9.2 or later.
What causes the vulnerability in REDHAT-BUG-1918168?
The vulnerability in REDHAT-BUG-1918168 is caused by a buffer overflow in the PyCArg_repr function when handling untrusted floating-point input.
Which versions of Python are affected by REDHAT-BUG-1918168?
REDHAT-BUG-1918168 affects Python versions 3.9.1 and earlier.
Can REDHAT-BUG-1918168 be exploited remotely?
Yes, REDHAT-BUG-1918168 can be exploited remotely if the application accepts untrusted floating-point numbers as input.
- agent/references
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3177
- agent/last-modified-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/python
- canonical/python babel localedata