CVE-2023-41419

Advisory

Reddit-experiments version 1.9.0 updates its gevent dependency from 21.12.0 to 23.9.0 to address the security vulnerability identified as CVE-2023-41419.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Bump `reddit-decider` to enable expose functionality on low-level decider by mrlevitas in https://github.com/reddit/experiments.py/pull/115
* feat: change log level for decider exceptions by aleksgapp in https://github.com/reddit/experiments.py/pull/116
* Bump gevent due to vulnerability by mrlevitas in https://github.com/reddit/experiments.py/pull/114
* Support Measured Rollouts and retire "owner" field by mrlevitas in https://github.com/reddit/experiments.py/pull/118


**Full Changelog**: https://github.com/reddit/experiments.py/compare/v1.8.0...v1.9.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41419
• https://github.com/reddit/experiments.py/pull/114/files#diff-f9d77b6d40ed3892a4d93df2b3fd88a012ab9844f6e143842b86f47e199c4611L11