PT-2024-40267 · Pypi · Pyo3
Published
2024-10-15
·
Updated
2024-10-15
CVSS v4.0
4.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
PyO3 versions prior to 0.23
Description:
The issue concerns a family of functions in PyO3 that read "borrowed" values from Python weak references. These functions were fundamentally unsound because the weak reference does not have ownership of the value, allowing the last strong reference to be cleared and the borrowed value to become dangling at any point.
Recommendations:
For PyO3 versions 0.22.4, the functions to read "borrowed" values have been deprecated and patched to leak a strong reference as a mitigation.
For versions prior to 0.22.4, update to version 0.22.4 to mitigate the issue.
For all affected versions, updating to PyO3 0.23 will remove these functions entirely, resolving the issue.
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pyo3