unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#46631: Python CVE-2021-3177
@ 2021-02-19  3:21 Leo Famulari
  2021-02-19 15:35 ` Ludovic Courtès
  2021-02-19 23:12 ` Leo Famulari
  0 siblings, 2 replies; 7+ messages in thread
From: Leo Famulari @ 2021-02-19  3:21 UTC (permalink / raw)
  To: 46631

Quoting from MITRE:

------
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution in certain
Python applications that accept floating-point numbers as untrusted
input, as demonstrated by a 1e300 argument to c_double.from_param. This
occurs because sprintf is used unsafely. 
------
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3177

There is not yet an upstream release to fix the issue in the 3.8 series
that we distribute. I believe there are patches we can cherry-pick. Can
somebody find them?

I assume that Python is considered to be "graft-able". Can anyone
confirm?

The upstream bug report:
https://bugs.python.org/issue42938




^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-02-23 19:18 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-19  3:21 bug#46631: Python CVE-2021-3177 Leo Famulari
2021-02-19 15:35 ` Ludovic Courtès
2021-02-19 23:12 ` Leo Famulari
2021-02-19 23:23   ` Leo Famulari
2021-02-19 23:41     ` Leo Famulari
2021-02-22  8:08       ` Ludovic Courtès
2021-02-23 19:16         ` Leo Famulari

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).