GHSA-qfc5-mcwq-26q8

Double Free in psutil

Source: GitHub Advisory Database (reviewed) High CVE-2019-18874

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	psutil	< 5.6.6	5.6.6

Details

As written in the advisory (Markdown source, shown as plain text).

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-18874 advisory
https://github.com/giampaolo/psutil/pull/1616 web
https://github.com/giampaolo/psutil/commit/7d512c8e4442a896d56505be3e78f1156f443465 web
https://github.com/advisories/GHSA-qfc5-mcwq-26q8 advisory
https://github.com/giampaolo/psutil package
https://github.com/giampaolo/psutil/blob/master/HISTORY.rst#566 web
https://github.com/pypa/advisory-database/tree/main/vulns/psutil/PYSEC-2019-41.yaml web
https://lists.debian.org/debian-lts-announce/2019/11/msg00018.html web
https://lists.fedoraproject.org/archives/list/[email protected]/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS web
https://lists.fedoraproject.org/archives/list/[email protected]/message/OLETTJYZL2SMBUI4Q2NGBMGPDPP54SRG web
https://usn.ubuntu.com/4204-1 web