{
  "threat_severity" : "Moderate",
  "public_date" : "2021-01-19T00:00:00Z",
  "bugzilla" : {
    "description" : "python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c",
    "id" : "1918168",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1918168"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-120",
  "details" : [ "Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.", "A flaw was found in python. A stack-based buffer overflow was discovered in the ctypes module provided within Python. Applications that use ctypes without carefully validating the input passed to it may be vulnerable to this flaw, which would allow an attacker to overflow a buffer on the stack and crash the application. The highest threat from this vulnerability is to system availability." ],
  "statement" : "This flaw could have had a higher Impact, however our packages are compiled with FORTIFY_SOURCE, which provides runtime protection to some memory and string functions and prevents this flaw from actually overwriting the buffer and potentially executing code.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2022-06-28T00:00:00Z",
    "advisory" : "RHSA-2022:5235",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "python-0:2.7.5-92.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-05-18T00:00:00Z",
    "advisory" : "RHSA-2021:1633",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python3-0:3.6.8-37.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-05-18T00:00:00Z",
    "advisory" : "RHSA-2021:1761",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python27:2.7-8040020210122160212.cdb2db54"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-05-18T00:00:00Z",
    "advisory" : "RHSA-2021:1879",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python38:3.8-8040020210128125034.b1b639b6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-05-18T00:00:00Z",
    "advisory" : "RHSA-2021:1633",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "python3-0:3.6.8-37.el8"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-babel-0:0.9.6-10.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-python-0:2.7.18-3.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-python-jinja2-0:2.6-16.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-python-pygments-0:1.5-5.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-babel-0:2.7.0-12.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-0:3.8.11-2.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-cryptography-0:2.8-5.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-jinja2-0:2.10.3-6.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-lxml-0:4.4.1-7.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-pip-0:19.3.1-2.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-urllib3-0:1.25.7-7.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-babel-0:0.9.6-10.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-python-0:2.7.18-3.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-python-jinja2-0:2.6-16.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3252",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "python27-python-pygments-0:1.5-5.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-babel-0:2.7.0-12.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-0:3.8.11-2.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-cryptography-0:2.8-5.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-jinja2-0:2.10.3-6.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-lxml-0:4.4.1-7.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-pip-0:19.3.1-2.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS",
    "release_date" : "2021-08-24T00:00:00Z",
    "advisory" : "RHSA-2021:3254",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-python38-python-urllib3-0:1.25.7-7.el7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Out of support scope",
    "package_name" : "python",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "python",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "python3",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "python36:3.6/python36",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "python39:3.9/python39",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "python2.7",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "python3.9",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-3177\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-3177" ],
  "name" : "CVE-2021-3177",
  "csaw" : false
}