CVE-2023-33595

Description

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

How to fix CVE-2023-33595

To remediate CVE-2023-33595, upgrade the affected package to a fixed version below.

• Bitnami/libpython—upgrade to 3.12.0-alpha8 or later
• Bitnami/python—upgrade to 3.12.0-alpha8 or later
• —upgrade to 3.12.0-alpha8 or later

Is CVE-2023-33595 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• >= 3.12.0-alpha0, < 3.12.0-alpha8
• >= 3.12.0-alpha0, < 3.12.0-alpha8
• >= 3.12.0-alpha0, < 3.12.0-alpha8

CVSS scores

References (3)

• WEBgithub.com/python/cpython/issues/103824
• WEBgithub.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a
• WEBnvd.nist.gov/vuln/detail/CVE-2023-33595