Use After Free Affecting pyo3 package, versions >=0.22.0 <0.22.4
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-PYO3-8220283
- published 16 Oct 2024
- disclosed 15 Oct 2024
- credit Unknown
Introduced: 15 Oct 2024
CVE-2024-9979 Open this link in a new tabHow to fix?
Upgrade pyo3 to version 0.22.4 or higher.
Overview
pyo3 is a package that provides Rust bindings for Python. This includes running and interacting with Python code from a Rust binary, as well as writing native Python modules.
Affected versions of this package are vulnerable to Use After Free via the functions get_object_borrowed, upgrade_borrowed,upgrade_borrowed_as ,upgrade_borrowed_as_exact and upgrade_borrowed_as_unchecked . An attacker can manipulate memory and access or modify freed memory locations by exploiting the unsound nature of these functions.