CVE-2023-33595: Use After Free

Published Jun 7, 2023

Updated

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function asciidecode at /Objects/unicodeobject.c.

Affected Software

2 affected components

Python CPython=3.12.0-alpha_7

Python Python=3.12.0-alpha7

Remediation

Patch Available

https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a

Event History

Jun 7, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-33595?

CVE-2023-33595 is a vulnerability in CPython v3.12.0 alpha 7 that allows a heap use-after-free via the function ascii_decode.

How severe is CVE-2023-33595?

CVE-2023-33595 has a severity of medium with a CVSS score of 5.5.

How does CVE-2023-33595 affect Python CPython?

CVE-2023-33595 affects Python CPython version 3.12.0 alpha 7.

How can I fix CVE-2023-33595?

There is no known fix for CVE-2023-33595 at the moment. It is recommended to follow the updates and patches provided by CPython.

Is there any reference for CVE-2023-33595?

Yes, you can find more information about CVE-2023-33595 in the following references: [Link 1](https://github.com/python/cpython/issues/103824) and [Link 2](https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a).