CVE-2021-3177
published 2021-01-19CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
18.85%
97.0th percentile
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | python2.7 | < python2.7 2.7.18-2 (bullseye) | python2.7 2.7.18-2 (bullseye) |
| debian | python3.9 | < python2.7 2.7.18-2 (bullseye) | python2.7 2.7.18-2 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | python3-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-curses-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-curses-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-debuginfo-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-debuginfo-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-devel-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-devel-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-libs-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-libs-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-pip-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-pip-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-setuptools-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-setuptools-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-test-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-test-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-tools-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-tools-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | python3-xml-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | python3-xml-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger input is a very large floating-point value (e.g. 1e300) passed to ctypes c_double.from_param; monitor Python applications accepting untrusted floating-point input via ctypes. ↗
- →Vulnerable code path is PyCArg_repr() in _ctypes/callproc.c; look for stack-based buffer overflow crash signatures originating from this function in Python process crash dumps or ASAN reports. ↗
- →Applications that use ctypes without carefully validating input are the attack surface; audit Python services that accept external floating-point data and pass it to ctypes. ↗
- ·Red Hat packages compiled with FORTIFY_SOURCE provide runtime protection that prevents the buffer overwrite and potential code execution, reducing impact to a crash/DoS on those builds. ↗
- ·The Ubuntu security fix for CVE-2021-3177 in Python 2.7 was temporarily reverted due to a regression; ensure the reinstated fix (USN-4754-4) is applied rather than the intermediate reverted package. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Oracle
Oracle Oracle Communications Risk Matrix: CNE (Python) — CVE-2021-3177
vendor_oracle·2022-07-15·CVSS 9.8
CVE-2021-3177 [CRITICAL] Oracle Oracle Communications Risk Matrix: CNE (Python) — CVE-2021-3177
Oracle Oracle Communications Risk Matrix: CNE (Python) vulnerability
CVE: CVE-2021-3177
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Ubuntu
Python vulnerability
vendor_ubuntu·2022-02-08·CVSS 9.8
CVE-2021-3177 [CRITICAL] Python vulnerability
Title: Python vulnerability
Summary: Python could be made to execute arbitrary code or denial of service if it
received a specially crafted input.
USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a
subsequent update removed the fix for CVE-2021-3177. This update reinstates
the security fix for CVE-2021-3177 in Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Networking (Python) — CVE-2021-3177
vendor_oracle·2022-01-15·CVSS 9.8
CVE-2021-3177 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: Networking (Python) — CVE-2021-3177
Oracle Oracle Enterprise Manager Risk Matrix: Networking (Python) vulnerability
CVE: CVE-2021-3177
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Pricing (Python) — CVE-2021-3177
vendor_oracle·2021-10-15·CVSS 9.8
CVE-2021-3177 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Pricing (Python) — CVE-2021-3177
Oracle Oracle Communications Applications Risk Matrix: Pricing (Python) vulnerability
CVE: CVE-2021-3177
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Oracle
Oracle Oracle Communications Applications Risk Matrix: UDC CORE (Python) — CVE-2021-3177
vendor_oracle·2021-07-15·CVSS 9.8
CVE-2021-3177 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: UDC CORE (Python) — CVE-2021-3177
Oracle Oracle Communications Applications Risk Matrix: UDC CORE (Python) vulnerability
CVE: CVE-2021-3177
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Ubuntu
Python vulnerabilities
vendor_ubuntu·2021-03-12·CVSS 7.5
CVE-2020-8492 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python 2.7 and Python 3.8.
USN-4754-1 fixed vulnerabilities in Python. This update provides
the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04.
In the case of Python 2.7 for 20.04, these additional fixes are included:
It was dicovered that Python allowed remote attackers to cause a denial of
service (resource consumption) via a ZIP bomb. (CVE-2019-9674)
It was discovered that Python had potentially misleading information about
whether sorting occurs. This fix updates the documentation about it.
(CVE-2019-17514)
It was discovered that Python incorrectly handled certain TAR archives.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-20907)
It was discovered that Python
Ubuntu
Python 2.7 vulnerability
vendor_ubuntu·2021-03-03·CVSS 9.8
CVE-2021-3177 [CRITICAL] Python 2.7 vulnerability
Title: Python 2.7 vulnerability
Summary: Python could be made to execute arbitrary code or denial of service if it
received a specially crafted input.
USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a
subsequent update removed the fix for CVE-2021-3177. This update reinstates
the security fix for CVE-2021-3177.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python regression
vendor_ubuntu·2021-02-25·CVSS 9.8
CVE-2021-3177 [CRITICAL] Python regression
Title: Python regression
Summary: USN-4754-1 introduced a regression in Python2.7.
USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a
regression in Python 2.7. This update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 9.8
CVE-2021-3177 [CRITICAL] Python vulnerabilities
Title: Python vulnerabilities
Summary: Python could be made to execute arbitrary code or denial of service if it
received a specially crafted input.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c
vendor_redhat·2021-01-19·CVSS 9.8
CVE-2021-3177 [CRITICAL] CWE-120 python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c
python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
A flaw was found in python. A stack-based buffer overflow was discovered in the ctypes module provided within Python. Applications that use ctypes without carefully validating the input passed to it may be vulnerable to this flaw, which would allow an attacker to overflow a buffer on the stack and crash the application. The highest threat from this vulnerability is to system availability.
Statement: This
Microsoft
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrust
vendor_msrc·2021-01-12·CVSS 9.8
CVE-2021-3177 [CRITICAL] CWE-120 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrust
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October
Debian
CVE-2021-3177: python2.7 - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callpro...
vendor_debian·2021·CVSS 9.8
CVE-2021-3177 [CRITICAL] CVE-2021-3177: python2.7 - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callpro...
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Scope: local
bullseye: resolved (fixed in 2.7.18-2)
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
GHSA
GHSA-hc96-xw56-vfwh: Python 3
ghsa_unreviewed·2022-05-24
CVE-2021-3177 [CRITICAL] CWE-120 GHSA-hc96-xw56-vfwh: Python 3
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
OSV
python2.7 vulnerability
osv·2022-02-08·CVSS 9.8
CVE-2021-3177 [CRITICAL] python2.7 vulnerability
python2.7 vulnerability
USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a
subsequent update removed the fix for CVE-2021-3177. This update reinstates
the security fix for CVE-2021-3177 in Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
OSV
python2.7, python3.7, python3.8 vulnerabilities
osv·2021-03-12·CVSS 7.5
CVE-2019-9674 [HIGH] python2.7, python3.7, python3.8 vulnerabilities
python2.7, python3.7, python3.8 vulnerabilities
USN-4754-1 fixed vulnerabilities in Python. This update provides
the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04.
In the case of Python 2.7 for 20.04, these additional fixes are included:
It was dicovered that Python allowed remote attackers to cause a denial of
service (resource consumption) via a ZIP bomb. (CVE-2019-9674)
It was discovered that Python had potentially misleading information about
whether sorting occurs. This fix updates the documentation about it.
(CVE-2019-17514)
It was discovered that Python incorrectly handled certain TAR archives.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-20907)
It was discovered that Python allowed an HTTP server to conduct Regular
Expression Den
OSV
python2.7 vulnerability
osv·2021-03-03·CVSS 9.8
CVE-2021-3177 [CRITICAL] python2.7 vulnerability
python2.7 vulnerability
USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a
subsequent update removed the fix for CVE-2021-3177. This update reinstates
the security fix for CVE-2021-3177.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
OSV
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
osv·2021-02-25·CVSS 9.8
CVE-2020-27619 [CRITICAL] python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
OSV
python2.7 regression
osv·2021-02-25·CVSS 9.8
CVE-2021-3177 [CRITICAL] python2.7 regression
python2.7 regression
USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a
regression in Python 2.7. This update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
OSV
CVE-2021-3177: Python 3
osv·2021-01-19·CVSS 9.8
CVE-2021-3177 [CRITICAL] CVE-2021-3177: Python 3
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
No detection rules found.
No public exploits indexed.
arXiv
Threat Assessment in Machine Learning based Systems
arxiv_fulltext·2022-06-30
Threat Assessment in Machine Learning based Systems
Threat Assessment in Machine Learning based Systems
Lionel Nganyewou Tidjon and Foutse Khomh, Senior Member, IEEE
The authors are with Polytechnique Montréal, Montréal, QC H3C 3A7, Canada.
E-mail: \lionel.tidjon, foutse.khomh\@polymtl.ca
## Abstract
Machine learning is a field of artificial intelligence (AI) that is becoming essential for several critical systems, making it a good target for threat actors. Threat actors exploit different Tactics, Techniques, and Procedures (TTPs) against the confidentiality, integrity, and availability of Machine Learning (ML) systems.
During the ML
cycle, they exploit adversarial TTPs to poison data and fool ML-based systems. In recent years, multiple security practices have been proposed for traditional systems but they are not enough to cope with th
HackerOne
Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1
hackerone·2021-08-25·CVSS 9.8
CVE-2021-3177 [CRITICAL] Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1
Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1
**TL;DR Description**
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. The CVE number used for this vulnerability is CVE-2021-3177.
**Details**
There's a buffer overflow in the PyCArg_repr() function in _ctypes/callproc.c.
The buffer overflow happens due to not checking the length of th sprintf() function on line:
case 'd':
sprintf(buffer, "",
self->tag, self->value.d);
break;
Because we control self->value.d we could make it copy _extreme_ val
https://bugs.python.org/issue42938https://github.com/python/cpython/pull/24239https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/04/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2022/02/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/https://news.ycombinator.com/item?id=26185005https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.htmlhttps://security.gentoo.org/glsa/202101-18https://security.netapp.com/advisory/ntap-20210226-0003/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://bugs.python.org/issue42938https://github.com/python/cpython/pull/24239https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/04/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2022/02/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/https://news.ycombinator.com/item?id=26185005https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.htmlhttps://security.gentoo.org/glsa/202101-18https://security.netapp.com/advisory/ntap-20210226-0003/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-01-19
Published