EXPOSURES › CVE-2021-3177
CVE-2021-3177
CRITICAL
DETAIL
SourceNVD · cve
Published2021-01-19
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2021-3177 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendordebian · vendorfedoraproject · vendorpython · vendoractive iq unified manager · productcommunications cloud native core network function cloud native environment · productcommunications offline mediation controller · productcommunications pricing design center · productdebian linux · productenterprise manager ops center · productfedora · productontap select deploy administration utility · productpython · productzfs storage appliance kit · product
DESCRIPTION
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |