Closed mend-bolt-for-github[bot] closed 4 years ago
Cross-platform lib for process and system monitoring in Python.
Library home page: https://files.pythonhosted.org/packages/c7/01/7c30b247cdc5ba29623faa5c8cf1f1bbf7e041783c340414b0ed7e067c64/psutil-5.5.1.tar.gz
Path to dependency file: /tmp/ws-scm/cSync/server/requirements.txt
Path to vulnerable library: /cSync/server/requirements.txt
Dependency Hierarchy: - :x: **psutil-5.5.1.tar.gz** (Vulnerable Library)
Found in HEAD commit: 3aea0a2755a44dba8cc43753d4e56118e7aaf9b6
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Publish Date: 2019-11-12
URL: CVE-2019-18874
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18874
Release Date: 2019-11-12
Fix Resolution: 5.6.6
Step up your Open Source Security Game with WhiteSource here
CVE-2019-18874 - High Severity Vulnerability
Cross-platform lib for process and system monitoring in Python.
Library home page: https://files.pythonhosted.org/packages/c7/01/7c30b247cdc5ba29623faa5c8cf1f1bbf7e041783c340414b0ed7e067c64/psutil-5.5.1.tar.gz
Path to dependency file: /tmp/ws-scm/cSync/server/requirements.txt
Path to vulnerable library: /cSync/server/requirements.txt
Dependency Hierarchy: - :x: **psutil-5.5.1.tar.gz** (Vulnerable Library)
Found in HEAD commit: 3aea0a2755a44dba8cc43753d4e56118e7aaf9b6
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Publish Date: 2019-11-12
URL: CVE-2019-18874
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18874
Release Date: 2019-11-12
Fix Resolution: 5.6.6
Step up your Open Source Security Game with WhiteSource here