PT-2023-24400 · Python · Cpython

Chgnrdv · Published 2023-06-07 · Updated 2025-08-11 · CVE-2023-33595

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CPython version 3.12.0 alpha 7

Description A heap use-after-free issue was discovered via the function ascii decode at /Objects/unicodeobject.c.

Recommendations For CPython version 3.12.0 alpha 7, consider disabling the ascii decode function as a temporary workaround until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BIT-LIBPYTHON-2023-33595

BIT-PYTHON-2023-33595

BIT-PYTHON-MIN-2023-33595

CVE-2023-33595

PSF-2023-3

Affected Products

Cpython

References · 10

• https://github.com/python/cpython/issues/103824 · Vendor Advisory
• https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a · Patch
• https://osv.dev/vulnerability/CVE-2023-33595 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2023-33595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33595 · Security Note
• https://osv.dev/vulnerability/PSF-2023-3 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-libpython-2023-33595 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2023-33595 · Vendor Advisory
• https://t.me/cvenotify/51970 · Telegram Post
• https://t.me/cvenotify/62964 · Telegram Post