CVE-2023-33595

Advisory

Python 3.12.0a7, as downloaded from Github repository after commit 13f942ac16ef53d2c7add6f299eddcaf9ad0dda5, was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
https://github.com/python/cpython/issues/103824

Affected package

Affected versions

Fixed versions

Vulnerability changelog

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. See CVE-2023-33595.


MISC:https://github.com/python/cpython/issues/103824: https://github.com/python/cpython/issues/103824
MISC:https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a: https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a

Resources

• https://github.com/python/cpython/issues/103824
• https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33595