~ / search / GHSA-6jgw-rgmm-7cv6

GHSA-6jgw-rgmm-7cv6

PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-9979

Packages

EcosystemPackageAffectedFixed in
crates.io pyo3 >= 0.22.0, < 0.22.4 0.22.4

Details

As written in the advisory (Markdown source, shown as plain text).

The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling. In PyO3 0.22.4 these functions have all been deprecated and patched to leak a strong reference as a mitigation. PyO3 0.23 will remove these functions entirely.

References

External links from the advisory. They lead to third-party sites.