Описание
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
A use-after-free vulnerability was found in Python via the heappushpop function in the heapq module. This flaw allows an attacker to submit a specially crafted request, causing a service disruption that leads to a denial of service attack.
Отчет
Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | python | Out of support scope | ||
| Red Hat Enterprise Linux 7 | python | Out of support scope | ||
| Red Hat Enterprise Linux 7 | python3 | Out of support scope | ||
| Red Hat Enterprise Linux 8 | gimp:flatpak/python2 | Affected | ||
| Red Hat Enterprise Linux 8 | inkscape:flatpak/python2 | Will not fix | ||
| Red Hat Enterprise Linux 8 | python3.11 | Not affected | ||
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Not affected | ||
| Red Hat Enterprise Linux 8 | python39:3.9/python39 | Not affected | ||
| Red Hat Enterprise Linux 9 | python3.11 | Not affected | ||
| Red Hat Enterprise Linux 9 | python3.9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
A use-after-free exists in Python through 3.9 via heappushpop in heapq ...
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Уязвимость интерпретатора языка программирования Python, связанная с использованием памяти после её освобождения, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3