GHSA-hwfp-hg2m-9vr2

Integer overflow in pywin32

Source: GitHub Advisory Database (reviewed) High CVE-2021-32559

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pywin32	< 301	301

Details

As written in the advisory (Markdown source, shown as plain text).

An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-32559 advisory
https://github.com/mhammond/pywin32/issues/1700 web
https://github.com/mhammond/pywin32/pull/1701 web
https://github.com/advisories/GHSA-hwfp-hg2m-9vr2 advisory
https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.md web
https://github.com/mhammond/pywin32 package
https://github.com/mhammond/pywin32/releases web
https://github.com/pypa/advisory-database/tree/main/vulns/pywin32/PYSEC-2021-112.yaml web