CVE-2021-3177

Advisory lineage Upstream: 0 Downstream: 34
Modified
Published: 19 Jan 2021, 00:00
Last modified:18 Dec 2025, 15:03

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.07% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

19 Jan 2021, 00:00
Published
Vulnerability first disclosed
18 Dec 2025, 15:03
Last Modified
Vulnerability information updated

Description

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.07%• Percentile: 22%

Techniques & Countermeasures

  • CWE-120•Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

    The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected Systems

  • debian•debian_linux

    9.0

  • fedoraproject•fedora

    32 | 33

  • netapp•active_iq_unified_manager

    na

  • netapp•ontap_select_deploy_administration_utility

    na

  • oracle•communications_cloud_native_core_network_function_cloud_native_environment

    22.2.0

  • oracle•communications_offline_mediation_controller

    12.0.0.3.0

  • oracle•communications_pricing_design_center

    12.0.0.3.0

  • oracle•enterprise_manager_ops_center

    12.4.0.0

  • oracle•zfs_storage_appliance_kit

    8.8

  • python•python

    ≥ 3.6.0, ≤ 3.6.12 | ≥ 3.7.0, ≤ 3.7.9 | ≥ 3.8.0, ≤ 3.8.7 | ≥ 3.9.0, ≤ 3.9.1

References (28)