CVE-2021-3177: buffer overflow when parsing floats

[quazgar]

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

See also https://ubuntu.com/security/CVE-2021-3177.

Fixed in 3.6.13.

[Leonidas S. Barbosa (leosilvab)]

Hey there,

There is a security update on going about this issue. Soon it's well tested we will publish it.

Thanks!

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[quazgar (quazgar)]

Just asking about the expected time the "well testing" is going to take for 3.6, so we can plan our server updates. For 3.8 the fix was released over a week ago.

[quazgar (quazgar)]

OK, according to https://ubuntu.com/security/CVE-2021-3177, the updated version has been released already, and the updated package show up in the repositores. So probably this bug can be closed?

[sgubuntuuser (sgubuntuuser)]

We have ran apt upgrade in our Ubuntu 18.04 systems and systems are up to date now. However, the vulnerability tools still show up that vulnerability is existing. Also when checking the Python3 version in systems it shows 3.6.9. As per the following page, the fixed version must be 3.6.9-1. Can anyone help on this? Thank you

https://ubuntu.com/security/CVE-2021-3177

[Seth Arnold (seth-arnold)]

On Sat, Jun 12, 2021 at 03:15:10PM -0000, sgubuntuuser wrote:
> We have ran apt upgrade in our Ubuntu 18.04 systems and systems are up
> to date now. However, the vulnerability tools still show up that
> vulnerability is existing. Also when checking the Python3 version in
> systems it shows 3.6.9. As per the following page, the fixed version
> must be 3.6.9-1. Can anyone help on this? Thank you
>
> https://ubuntu.com/security/CVE-2021-3177

Hello, I'm unable to reproduce what your tool is reporting:

root@u18:~# dpkg -l python3.6
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture
+++-=====================================-=======================-============
ii python3.6 3.6.9-1~18.04ubuntu1.4 amd64
root@u18:~# python3
Python 3.6.9 (default, Jan 26 2021, 15:33:00)
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from ctypes import *
>>> c_double.from_param(1e300)
<cparam 'd' (1e+300)>
>>>

How is your tool determining that this isn't fixed?

Thanks