Vulnerability · Published Jan 19, 2021 · Assigned by mitre

CVE-2021-3177

Critical 9.8

In plain English

A critical-severity buffer overflow in the python-psycopg2-doc package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 24.0% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)24.0%top 2.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	python-psycopg2-doc	2.7.5-7.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python-sqlalchemy-doc	1.3.2-2.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python-sqlalchemy-doc	1.3.2-2.module_el8.5.0+2569+5c5719bc	ALSA-2021:1761
AlmaLinux:8	python2-Cython	0.28.1-7.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-PyMySQL	0.8.0-10.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-attrs	17.4.0-10.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-backports	1.0-16.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-backports-ssl_match_hostname	3.5.0.1-12.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-chardet	3.0.4-10.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-coverage	4.5.1-4.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-dns	1.15.0-10.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-docs	2.7.16-2.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-docs-info	2.7.16-2.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-docutils	0.14-12.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-funcsigs	1.0.2-13.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-idna	2.5-7.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-ipaddress	1.0.18-6.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-markupsafe	0.23-19.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-mock	2.0.0-13.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-numpy	1:1.14.2-16.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-numpy-doc	1:1.14.2-16.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-numpy-f2py	1:1.14.2-16.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-pluggy	0.6.0-8.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-psycopg2	2.7.5-7.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-psycopg2-debug	2.7.5-7.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-psycopg2-tests	2.7.5-7.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-py	1.5.3-6.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-pysocks	1.6.8-6.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-pytest	3.4.2-13.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-pytest-mock	1.9.0-4.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-pytz	2017.2-12.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-pyyaml	3.12-16.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-requests	2.20.0-3.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-rpm-macros	3-38.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-setuptools	39.0.1-13.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-setuptools-wheel	39.0.1-13.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-setuptools_scm	1.15.7-6.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-six	1.11.0-6.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-sqlalchemy	1.3.2-2.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python2-urllib3	1.24.2-3.module_el8.6.0+2781+fed64c13	ALSA-2021:1761
AlmaLinux:8	python38-Cython	0.29.14-4.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-PyMySQL	0.10.1-1.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-asn1crypto	1.2.0-3.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-cffi	1.13.2-3.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-chardet	3.0.4-19.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-cryptography	2.8-3.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-idna	2.8-6.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-markupsafe	1.1.1-6.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-mod_wsgi	4.6.8-3.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-ply	3.11-10.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-psycopg2	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-psycopg2-doc	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-psycopg2-tests	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-pycparser	2.19-3.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-pysocks	1.7.1-4.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-pytz	2019.3-3.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-requests	2.22.0-9.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-scipy	1.3.1-4.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
AlmaLinux:8	python38-six	1.12.0-10.module_el8.6.0+2778+cd494b30	ALSA-2021:1879
Alpine:v3.20	python3	3.8.7-r2	ALPINE-CVE-2021-3177
Alpine:v3.21	python3	3.8.7-r2	ALPINE-CVE-2021-3177
Alpine:v3.22	python3	3.8.7-r2	ALPINE-CVE-2021-3177
Alpine:v3.23	python3	3.8.7-r2	ALPINE-CVE-2021-3177
Alpine:v3.24	python3	3.8.7-r2	ALPINE-CVE-2021-3177
Rocky Linux:8	Cython	0:0.28.1-7.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	Cython	0:0.28.1-7.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	Cython	0:0.29.14-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	PyYAML	0:3.12-16.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	PyYAML	0:3.12-16.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	PyYAML	0:5.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	babel	0:2.5.1-9.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	babel	0:2.7.0-10.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	mod_wsgi	0:4.6.8-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	numpy	1:1.14.2-16.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	numpy	1:1.14.2-16.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	numpy	0:1.17.3-5.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	pytest	0:3.4.2-13.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	pytest	0:3.4.2-13.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-PyMySQL	0:0.8.0-10.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-PyMySQL	0:0.10.1-1.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-PyMySQL	0:0.10.1-1.module+el8.5.0+672+ab6eb015	RLSA-2021:1879
Rocky Linux:8	python-PyMySQL	0:0.8.0-10.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-asn1crypto	0:1.2.0-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-attrs	0:17.4.0-10.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-attrs	0:17.4.0-10.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-backports	0:1.0-16.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-backports-ssl_match_hostname	0:3.5.0.1-12.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-cffi	0:1.13.2-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-chardet	0:3.0.4-10.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-chardet	0:3.0.4-10.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-chardet	0:3.0.4-19.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-coverage	0:4.5.1-4.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-coverage	0:4.5.1-4.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.5.0+672+ab6eb015	RLSA-2021:1879
Rocky Linux:8	python-dns	0:1.15.0-10.module+el8.7.0+1062+663ba31c	RLSA-2021:1761
Rocky Linux:8	python-dns	0:1.15.0-10.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-dns	0:1.15.0-10.el8	RLSA-2021:1761
Rocky Linux:8	python-docs	0:2.7.16-2.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-docutils	0:0.14-12.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-docutils	0:0.14-12.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-funcsigs	0:1.0.2-13.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-idna	0:2.5-7.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-idna	0:2.5-7.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-idna	0:2.8-6.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-ipaddress	0:1.0.18-6.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-jinja2	0:2.10-8.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-jinja2	0:2.10.3-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-lxml	0:4.2.3-4.el8	RLSA-2021:1761
Rocky Linux:8	python-lxml	0:4.4.1-5.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-lxml	0:4.2.3-4.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-markupsafe	0:0.23-19.el8	RLSA-2021:1761
Rocky Linux:8	python-markupsafe	0:0.23-19.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-markupsafe	0:1.1.1-6.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-mock	0:2.0.0-13.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-nose	0:1.3.7-30.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-pluggy	0:0.6.0-8.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-pluggy	0:0.6.0-8.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-ply	0:3.11-10.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-psutil	0:5.6.4-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-psycopg2	0:2.7.5-7.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-psycopg2	0:2.7.5-7.el8	RLSA-2021:1761
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.6.0+794+eba84017	RLSA-2021:1879
Rocky Linux:8	python-py	0:1.5.3-6.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-py	0:1.5.3-6.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-pycparser	0:2.19-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-pygments	0:2.2.0-20.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-pymongo	0:3.6.1-11.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-pysocks	0:1.7.1-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-pysocks	0:1.6.8-6.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-pysocks	0:1.6.8-6.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-pytest-mock	0:1.9.0-4.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-requests	0:2.20.0-3.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-requests	0:2.22.0-9.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-requests	0:2.20.0-3.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-setuptools_scm	0:1.15.7-6.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-sqlalchemy	0:1.3.2-2.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-sqlalchemy	0:1.3.2-2.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-urllib3	0:1.24.2-3.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python-urllib3	0:1.25.7-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-urllib3	0:1.24.2-3.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	python-virtualenv	0:15.1.0-19.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python-wheel	0:0.33.6-5.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python-wheel	1:0.31.1-2.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	python2	0:2.7.18-4.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python2-pip	0:9.0.3-18.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python2-rpm-macros	0:3-38.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python2-setuptools	0:39.0.1-13.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python2-six	0:1.11.0-6.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	python38	0:3.8.6-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python3x-pip	0:19.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python3x-setuptools	0:41.6.0-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	python3x-six	0:1.12.0-10.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	pytz	0:2017.2-12.module+el8.5.0+706+735ec4b3	RLSA-2021:1761
Rocky Linux:8	pytz	0:2019.3-3.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	pytz	0:2017.2-12.module+el8.4.0+403+9ae17a31	RLSA-2021:1761
Rocky Linux:8	scipy	0:1.0.0-20.module+el8.3.0+120+426d8baf	RLSA-2021:1761
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.4.0+570+c2eaf144	RLSA-2021:1879
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.5.0+672+ab6eb015	RLSA-2021:1879
Ubuntu:22.04:LTS	python3.10	3.10.12-1~22.04.4	USN-6891-1

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://bugs.python.org/issue42938
https://github.com/python/cpython/pull/24239
https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html
FEDORA-2021-faf88b9499 vendor-advisory
FEDORA-2021-cc3ff94cfc vendor-advisory
GLSA-202101-18 vendor-advisory
FEDORA-2021-e3a5a74610 vendor-advisory
FEDORA-2021-ced31f3f0c vendor-advisory
FEDORA-2021-42ba9feb47 vendor-advisory
FEDORA-2021-076a2dccba vendor-advisory
FEDORA-2021-851c6e4e2d vendor-advisory
FEDORA-2021-66547ff92d vendor-advisory
FEDORA-2021-17668e344a vendor-advisory
FEDORA-2021-d5cde50865 vendor-advisory
FEDORA-2021-7547ad987f vendor-advisory
FEDORA-2021-f4fd9372c7 vendor-advisory
FEDORA-2021-3352c1c802 vendor-advisory
[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar mailing-list
FEDORA-2021-907f3bacae vendor-advisory
[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update mailing-list
https://www.oracle.com//security-alerts/cpujul2021.html
https://news.ycombinator.com/item?id=26185005
https://security.netapp.com/advisory/ntap-20210226-0003/
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujan2022.html
[debian-lts-announce] 20220212 [SECURITY] [DLA 2919-1] python2.7 security update mailing-list
https://www.oracle.com/security-alerts/cpujul2022.html
[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update mailing-list
https://cert-portal.siemens.com/productcert/html/ssa-398330.html