GNU bug report logs

#46631 Python CVE-2021-3177

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

Received: (at submit) by debbugs.gnu.org; 19 Feb 2021 03:21:43 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu Feb 18 22:21:43 2021
Received: from localhost ([127.0.0.1]:48583 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lCwMR-0001Ck-9N
	for submit@debbugs.gnu.org; Thu, 18 Feb 2021 22:21:43 -0500
Received: from lists.gnu.org ([209.51.188.17]:57416)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <leo@famulari.name>) id 1lCwMP-0001Cc-NH
 for submit@debbugs.gnu.org; Thu, 18 Feb 2021 22:21:42 -0500
Received: from eggs.gnu.org ([2001:470:142:3::10]:42900)
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <leo@famulari.name>) id 1lCwMP-0008Pi-HF
 for bug-guix@gnu.org; Thu, 18 Feb 2021 22:21:41 -0500
Received: from wout4-smtp.messagingengine.com ([64.147.123.20]:42015)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <leo@famulari.name>) id 1lCwMN-00071U-Jm
 for bug-guix@gnu.org; Thu, 18 Feb 2021 22:21:41 -0500
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44])
 by mailout.west.internal (Postfix) with ESMTP id C113EC79;
 Thu, 18 Feb 2021 22:21:37 -0500 (EST)
Received: from mailfrontend1 ([10.202.2.162])
 by compute4.internal (MEProxy); Thu, 18 Feb 2021 22:21:37 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name;
 h=date:from:to:subject:message-id:mime-version:content-type; s=
 mesmtp; bh=p2GuoJtMRPEqWaWHvpOz5VT9yNrfY+3zCEPG9oKXJbU=; b=QURD+
 X8tpFlMH98mavf6JIyv+Tmv6f4kPaOkIjXEyE2ZL/dAklyKsuX+mZ6djaOnEA1AR
 S6Tv+a9vkPgSR3TOZU5CxuxMz4g3rpP3GS1jZ6oqz6sbpGNciYBYGvxghwRLwc0X
 5bXjXInbioztEECrWu9/A9DXSBFF1e/w7SpnB8=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
 messagingengine.com; h=content-type:date:from:message-id
 :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender
 :x-me-sender:x-sasl-enc; s=fm2; bh=p2GuoJtMRPEqWaWHvpOz5VT9yNrfY
 +3zCEPG9oKXJbU=; b=F29dZGCdqmx+ZO8JojJo2L2wnh7206e15O+kZl1DiEL1k
 asqRB2vIzL5k9pT6VOLROUXLrvYfv4sqdospJxZCvGgFn6hQuMvfm7ASTMw76Sju
 sHArQehyx79Y5xph0wuYUh3R4eGyf117g0cC41IuSNLGJcXG60URXYC4SCAjkGy8
 fXfgB/mcTcUvu8pk/RqtwWFer6Bo/NsNR1+9cMWpLl3InhqxpyHxabPhmWZG44ww
 ictOFDM1HQ92DeIqnkN7FHI80yqgu5WyRrxIJf/VFKbexCQod83wSCAeF27g7Ygc
 BO9qGgXupFxy0GXRUSJH6YgxY9HIUtP27vELMvy8Q==
X-ME-Sender: <xms:wS4vYGVsIXkm7mRGPiLYZRENMItfX24dBhoBKOWuwkE5wXlh-HMrjA>
 <xme:wS4vYF3tN1ItzW_uEqUDAWpwwFC1Itu06wb21lICayhoxxHbojTjWrg7QfXUM0XT1
 RwrLnnZeN2xNtItKw>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrjeehgdehiecutefuodetggdotefrodftvf
 curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu
 uegrihhlohhuthemuceftddtnecunecujfgurhepfffhvffukfggtggusehttdertddttd
 dvnecuhfhrohhmpefnvghoucfhrghmuhhlrghrihcuoehlvghosehfrghmuhhlrghrihdr
 nhgrmhgvqeenucggtffrrghtthgvrhhnpeffueeuieeuieefuefgteeghfelgeefvedvtd
 duvedtgffffeeiteeviefgveetheenucffohhmrghinhepmhhithhrvgdrohhrghdpphih
 thhhohhnrdhorhhgnecukfhppeeiledruddvtddrledvrddvtdeknecuvehluhhsthgvrh
 fuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheplhgvohesfhgrmhhulhgrrhhi
 rdhnrghmvg
X-ME-Proxy: <xmx:wS4vYD0imKG89kqQ3gIltsZhuoxu9G8nED4nEYTAeshEK2T1UtwuuA>
 <xmx:wS4vYI_dJl04mNwm0rXIcbY2N6ZuLN0GHV2FOVmblrUpNYNbXxSvQw>
 <xmx:wS4vYA1RAOF8syJ5bTmNjWF4Gnn0Fmq1OxLWi81b5i9UO7D5Z8js3Q>
 <xmx:wS4vYIWl_yUQHF1aWjw92TfYhsvHck1YaV9S_i-yew4Mqc9idmXtzg>
Received: from localhost (ool-45785cd0.dyn.optonline.net [69.120.92.208])
 by mail.messagingengine.com (Postfix) with ESMTPA id 383EF24005A
 for <bug-guix@gnu.org>; Thu, 18 Feb 2021 22:21:37 -0500 (EST)
Date: Thu, 18 Feb 2021 22:21:34 -0500
From: Leo Famulari <leo@famulari.name>
To: bug-guix@gnu.org
Subject: Python CVE-2021-3177
Message-ID: <YC8uvtnvGyXcCno1@jasmine.lan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Received-SPF: pass client-ip=64.147.123.20; envelope-from=leo@famulari.name;
 helo=wout4-smtp.messagingengine.com
X-Spam_score_int: -27
X-Spam_score: -2.8
X-Spam_bar: --
X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,
 SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.4 (-)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -2.4 (--)
Quoting from MITRE:

------
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution in certain
Python applications that accept floating-point numbers as untrusted
input, as demonstrated by a 1e300 argument to c_double.from_param. This
occurs because sprintf is used unsafely. 
------
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3177

There is not yet an upstream release to fix the issue in the 3.8 series
that we distribute. I believe there are patches we can cherry-pick. Can
somebody find them?

I assume that Python is considered to be "graft-able". Can anyone
confirm?

The upstream bug report:
https://bugs.python.org/issue42938




Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 16:37:43 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.