Bug 1212127 (CVE-2023-33595)

Summary:	VUL-0: CVE-2023-33595: python27,python310,python36,python311,python,python39,python3: CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Gianluca Gabrielli <gianluca.gabrielli>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None	CC:	security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/368795/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Gianluca Gabrielli 2023-06-08 07:10:11 UTC

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the
function ascii_decode at /Objects/unicodeobject.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-33595
https://www.cve.org/CVERecord?id=CVE-2023-33595
https://github.com/python/cpython/issues/103824
https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a

Comment 1 Gianluca Gabrielli 2023-06-08 07:10:54 UTC

All our packages seems to not be affected.