CVE-2017-1000158

Integer overflow in PyString_DecodeEscape function

• CVSS 9.8
• CWE-190 Integer Overflow or Wraparound
• Numeric Errors
• Local

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in a heap-based buffer overflow (and possible arbitrary code execution)

CVE

CVE-2017-1000158

CWE

CWE-190 Integer Overflow or Wraparound

CVSS base score

9.8

Published

2017-11-17

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Numeric Errors

Subcategory

Integer Overflows

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Python to a version that addresses the problem.

def vulnerable_decode_escape(input_string):
    return input_string.encode('utf-8').decode('unicode_escape')

if __name__ == "__main__":
    input_string = "some_string_with_escape_sequences" + "\x7f" * (2**31)

    try:
        result = vulnerable_decode_escape(input_string)
        print("Decoded string:", result)
    except Exception as e:
        print("Error:", e)

import sys

def safe_decode_escape(input_string):
    try:
        decoded_string = input_string.encode('utf-8').decode('unicode_escape')
        return decoded_string
    except (UnicodeDecodeError, OverflowError) as e:
        print("Error decoding string:", e)
        return None

if __name__ == "__main__":
    input_string = "some_string_with_escape_sequences"
    
    result = safe_decode_escape(input_string)
    if result is not None:
        print("Decoded string:", result)

@misc{vaitp:cve20171000158,
  title        = {{Integer overflow in PyString_DecodeEscape function}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-1000158},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-1000158/}}
}