CVE-2017-1000158

Critical

Published: 17/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CPython (also known as Python) up to version 2.7.13 is vulnerable to a heap-based buffer overflow caused by an integer overflow in the PyString_DecodeEscape function in stringobject.c, potentially leading to arbitrary code execution.

Risk Assessment

Exploitation of this vulnerability could allow an attacker to execute arbitrary code on the server, posing a serious threat to application and data security.

Recommendation

It is recommended to upgrade CPython to the latest version to mitigate this vulnerability and conduct a code audit to identify potential risks.

Original NVD description (English source)

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)