CVE-2023-33595

Published: 7 June 2023

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

Notes

This vulnerability was introduced in upstream commit
1ef61cf71a218c71860ff6aecf0fd51edb8b65dc and the fix was also committed
upstream in commit d5a97074d24cd14cb2a35a2b1ad3074863cde264 - both of
these were part of the 3.12.0b1 release, so no versions of python3.12 in
ubuntu were affected (also no other python3.x versions are affected as the
original vulnerable commit was only released during the development of
python 3.12)

Status

Severity score breakdown

References

• https://github.com/python/cpython/issues/103824
• https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a
• https://www.cve.org/CVERecord?id=CVE-2023-33595
• NVD
• Launchpad
• Debian