CVE-2017-1000158

moderate-risk

Published 2017-11-17

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

Do I need to act?

3.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: ca079a3ea30098aff3197c559a0e32d42dda6d84, a61d7f2490fd677343c28ac53e1b41cdb0e1d998, 27657e7cea26548958518144d63200d7a2333d1c

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (4)

Debian Linux

Python

Affected Vendors

Debian Python

References (18)

Third Party Advisory http://www.securitytracker.com/id/1039890

Issue Tracking https://bugs.python.org/issue30657

Mailing List https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html

Mailing List https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html

Mailing List https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html

Mailing List https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html

Third Party Advisory https://security.gentoo.org/glsa/201805-02

https://security.netapp.com/advisory/ntap-20230216-0001/

Third Party Advisory https://www.debian.org/security/2018/dsa-4307