PT-2024-40490 · Pypi · Pyo3
Published
2024-12-05
·
Updated
2024-12-05
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
PyO3 versions 0.23.0 through 0.23.2
Description
The issue arises from a regression in the
PYO3 CONFIG FILE environment variable, which is used to configure builds. This regression causes PyO3 to fail to reconfigure and recompile when the environment variable is changed. As a result, when using tools like maturin to build for multiple versions in a single build, Python wheels may be compiled against the wrong Python API version. Affected wheels are highly unstable and can cause the Python interpreter to crash in unpredictable ways.Recommendations
For PyO3 versions 0.23.0 through 0.23.2, update to PyO3 0.23.3 and rebuild to prevent the creation of unstable wheels.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pyo3