psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4324 advisory.

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4162 advisory.

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

  - In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content     retrieved via HTTP. (CVE-2020-27619)

  - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the     `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most     exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format     user content instead of the urlize filter, or by implementing request timeouts and limiting process     memory. (CVE-2020-28493)

  - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

  - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
    (CVE-2021-28957)

  - In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP     address string. This (in some situations) allows attackers to bypass access control that is based on IP     addresses. (CVE-2021-29921)

  - An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in     the authority component, the authority regular expression exhibits catastrophic backtracking, causing a     denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
    (CVE-2021-33503)

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

  - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote     attacker could possibly use this issue to install a different revision on a repository. The highest threat     from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)

  - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing     serialized Python objects) via directory traversal, leading to code execution. (CVE-2021-42771)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 374793ad-2720-4c4a-b86c-fc4a1780deac advisory.

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4299 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

  - python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  - python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

  - python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

  - python-urllib3: CRLF injection via HTTP request method (CVE-2020-26137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4324 advisory.

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4162 advisory.

  - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

  - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing     serialized Python objects) via directory traversal, leading to code execution. (CVE-2021-42771)

  - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote     attacker could possibly use this issue to install a different revision on a repository. The highest threat     from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)

  - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the     `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most     exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format     user content instead of the urlize filter, or by implementing request timeouts and limiting process     memory. (CVE-2020-28493)

  - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
    (CVE-2021-28957)

  - In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP     address string. This (in some situations) allows attackers to bypass access control that is based on IP     addresses. (CVE-2021-29921)

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

  - An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in     the authority component, the authority regular expression exhibits catastrophic backtracking, causing a     denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
    (CVE-2021-33503)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4324 advisory.

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4162 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

  - python: Unsafe use of eval() on data retrieved via HTTP in the test suite (CVE-2020-27619)

  - python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

  - python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in     query parameters (CVE-2021-23336)

  - python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

  - python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

  - python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

  - python: Information disclosure via pydoc (CVE-2021-3426)

  - python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

  - python-babel: Relative path traversal allows attacker to load arbitrary locale files and     execute arbitrary code (CVE-2021-42771)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:4324 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4162 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

  - python: Unsafe use of eval() on data retrieved via HTTP in the test suite (CVE-2020-27619)

  - python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

  - python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in     query parameters (CVE-2021-23336)

  - python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

  - python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

  - python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

  - python: Information disclosure via pydoc (CVE-2021-3426)

  - python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

  - python-babel: Relative path traversal allows attacker to load arbitrary locale files and     execute arbitrary code (CVE-2021-42771)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:4324 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1313 advisory.

  - rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection     responses (CVE-2015-1820)

  - rubygem-rest-client: unsanitized application logging (CVE-2015-3448)

  - foreman: Managing repositories with their id via hammer does not respect the role filters (CVE-2017-2662)

  - rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

  - rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

  - netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)

  - foreman: world-readable OMAPI secret through the ISC DHCP server (CVE-2020-14335)

  - rubygem-activeview: Cross-site scripting in translation helpers (CVE-2020-15169)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - rubygem-activestorage: circumvention of file size limits in ActiveStorage (CVE-2020-8162)

  - rubygem-actionpack: possible strong parameters bypass (CVE-2020-8164)

  - rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and     RedisCacheStore (CVE-2020-8165)

  - rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token (CVE-2020-8166)

  - rubygem-actionview: CSRF vulnerability in rails-ujs (CVE-2020-8167)

  - rubygem-rails: untrusted users able to run pending migrations in production (CVE-2020-8185)

  - django: potential SQL injection via tolerance parameter in GIS functions and aggregates on Oracle     (CVE-2020-9402)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2593 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2635 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2583 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to 5.6.7 to fix CVE-2019-18874

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Riccardo Schirone discovered that psutil incorrectly handled certain reference counting operations. An attacker could use this issue to cause psutil to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there were multiple double free vulnerabilities in python-psutil, a Python module providing convenience functions for accessing system process data.

This was caused by incorrect reference counting handling within for/while loops that convert system data into said Python objects.

For Debian 8 'Jessie', this issue has been fixed in python-psutil version 2.1.1-1+deb8u1.

We recommend that you upgrade your python-psutil packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184938	Rocky Linux 8 : python-psutil (RLSA-2021:4324)	Nessus	Rocky Linux Local Security Checks	high
184819	Rocky Linux 8 : python38:3.8 and python38-devel:3.8 (RLSA-2021:4162)	Nessus	Rocky Linux Local Security Checks	critical
174300	FreeBSD : py-psutil -- double free vulnerability (374793ad-2720-4c4a-b86c-fc4a1780deac)	Nessus	FreeBSD Local Security Checks	high
170303	RHEL 7 : rh-python38 (RHSA-2020:4299)	Nessus	Red Hat Local Security Checks	high
157579	AlmaLinux 8 : python-psutil (ALSA-2021:4324)	Nessus	Alma Linux Local Security Checks	high
155969	Oracle Linux 8 : python38:3.8 / and / python38-devel:3.8 (ELSA-2021-4162)	Nessus	Oracle Linux Local Security Checks	critical
155410	Oracle Linux 8 : python-psutil (ELSA-2021-4324)	Nessus	Oracle Linux Local Security Checks	high
155193	RHEL 8 : python38:3.8 and python38-devel:3.8 (RHSA-2021:4162)	Nessus	Red Hat Local Security Checks	critical
155111	RHEL 8 : python-psutil (RHSA-2021:4324)	Nessus	Red Hat Local Security Checks	high
155064	CentOS 8 : python38:3.8 and python38-devel:3.8 (CESA-2021:4162)	Nessus	CentOS Local Security Checks	critical
155046	CentOS 8 : python-psutil (CESA-2021:4324)	Nessus	CentOS Local Security Checks	high
148903	RHEL 7 : Satellite 6.9 Release (Moderate) (RHSA-2021:1313)	Nessus	Red Hat Local Security Checks	high
138029	RHEL 7 : OpenShift Container Platform 4.2.36 python-psutil (RHSA-2020:2593)	Nessus	Red Hat Local Security Checks	high
137756	RHEL 7 : OpenShift Container Platform 4.3.26 python-psutil (RHSA-2020:2635)	Nessus	Red Hat Local Security Checks	high
137726	RHEL 7 : OpenShift Container Platform 4.4.9 python-psutil (RHSA-2020:2583)	Nessus	Red Hat Local Security Checks	high
134056	Fedora 30 : python-psutil (2020-a06ebafad8)	Nessus	Fedora Local Security Checks	high
131560	Ubuntu 16.04 LTS / 18.04 LTS : psutil vulnerability (USN-4204-1)	Nessus	Ubuntu Local Security Checks	high
131137	Debian DLA-1998-1 : python-psutil security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-18874

high

Tenable Plugins

high

critical

high

high

high

critical

high

critical

high

critical

high

high

high

high

high

high

high

high