CVE-2019-18874 (High) detected in psutil-5.4.3.tar.gz

[mend-bolt-for-github[bot]]

CVE-2019-18874 - High Severity Vulnerability

Vulnerable Library - psutil-5.4.3.tar.gz

Cross-platform lib for process and system monitoring in Python.

Library home page: https://files.pythonhosted.org/packages/e2/e1/600326635f97fee89bf8426fef14c5c29f4849c79f68fd79f433d8c1bd96/psutil-5.4.3.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/tmp/ws-scm/easybuggy4django.old

Dependency Hierarchy: - :x: **psutil-5.4.3.tar.gz** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

Publish Date: 2019-11-12

URL: CVE-2019-18874

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18874

Release Date: 2019-11-12

Fix Resolution: 5.6.6

---

Step up your Open Source Security Game with Mend here