PYSEC-2019-41

At a glance

Published: 2019-11-12 02:15 UTC
Updated: 2023-11-08 04:01 UTC
CVE: CVE-2019-18874
Aliases: GHSA-qfc5-mcwq-26q8

Description

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

Affected packages

Package	Versions
PyPI · psutil	introduced 0, fixed 5.6.6

References

https://github.com/giampaolo/psutil/pull/1616 WEB
https://lists.debian.org/debian-lts-announce/2019/11/msg00018.html WEB
https://usn.ubuntu.com/4204-1/ WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS/ WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLETTJYZL2SMBUI4Q2NGBMGPDPP54SRG/ WEB
https://github.com/advisories/GHSA-qfc5-mcwq-26q8 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database