CVE-2023-29824: Use After Free
DISPUTED A use-after-free issue was discovered in PyFindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue.
Other sources
DISPUTED A use-after-free issue was discovered in PyFindObjects() function in SciPy versions prior to 1.8.0.
https://github.com/scipy/scipy/issues/14713 http://www.square16.org/achievement/cve-2023-29824/ https://github.com/scipy/scipy/pull/15013 https://github.com/scipy/scipy/issues/14713#issuecomment-1629468565
— Red Hat
Withdrawn Advisory
This advisory has been withdrawn because it has been found to not be an issue. Please see the issue here for more information.
## Original Description
A use-after-free issue was discovered in PyFindObjects() function in SciPy versions prior to 1.8.0.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29824?
The severity of CVE-2023-29824 is disputed, as both the vendor and the discoverer indicate that it is not a security issue.
How do I fix CVE-2023-29824?
To fix CVE-2023-29824, upgrade to SciPy version 1.8.0 or later.
Which versions of SciPy are affected by CVE-2023-29824?
CVE-2023-29824 affects SciPy versions prior to 1.8.0.
Is CVE-2023-29824 a confirmed security vulnerability?
CVE-2023-29824 is considered not to be a confirmed security vulnerability according to the vendor and discoverer.
What is the nature of the issue in CVE-2023-29824?
CVE-2023-29824 describes a use-after-free issue in the Py_FindObjects() function.