Vulnerability Name:

CVE-2019-18874 (CCN-171612)

Assigned:2019-11-07
Published:2019-11-07
Updated:2019-11-18
Summary:psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
7.0 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.1 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-415
CWE-416
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-18874

Source: XF
Type: UNKNOWN
psutil-cve201918874-dos(171612)

Source: CCN
Type: psutil GIT Repository
Use Py_CLEAR instead of Py_DECREF to also set the variable to NULL #1616

Source: MISC
Type: Third Party Advisory
https://github.com/giampaolo/psutil/pull/1616

Source: MLIST
Type: UNKNOWN
[debian-lts-announce] 20191118 [SECURITY] [DLA 1998-1] python-psutil security update

Source: FEDORA
Type: UNKNOWN
FEDORA-2020-a06ebafad8

Source: FEDORA
Type: UNKNOWN
FEDORA-2020-021fb887ac

Source: UBUNTU
Type: UNKNOWN
USN-4204-1

Source: CCN
Type: IBM Security Bulletin 6410866 (Spectrum Protect Plus)
Vulnerability in psutil affects IBM Spectrum Protect Plus backup and restore of Db2 and MongoDB databases (CVE-2019-18874)

Source: CCN
Type: IBM Security Bulletin 6410874 (Spectrum Protect Plus)
Vulnerabilities in psutil, python, and Golang affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Source: CCN
Type: IBM Security Bulletin 6614909 (Spectrum Discover)
IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Vulnerable Configuration:Configuration 1:
  • cpe:/a:psutil_project:psutil:*:*:*:*:*:*:*:* (Version <= 5.6.5)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:psutil_project:psutil:5.6.5:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:spectrum_protect_plus:10.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201918874
    V
    		CVE-2019-18874
    2023-06-22
    oval:com.redhat.rhsa:def:20214162
    P
    		RHSA-2021:4162: python38:3.8 and python38-devel:3.8 security update (Moderate)
    2021-11-09
    oval:com.redhat.rhsa:def:20214324
    P
    		RHSA-2021:4324: python-psutil security update (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:60393
    P
    		Security update for postgresql10 (Important)
    2021-10-20
    oval:org.opensuse.security:def:61627
    P
    		policycoreutils-2.8-9.19 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61688
    P
    		zsh-5.6-5.17 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61689
    P
    		zypper-1.14.27-1.11 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61603
    P
    		libzzip-0-13-0.13.69-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61604
    P
    		logrotate-3.13.0-4.3.9 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63350
    P
    		libspice-server-devel-0.14.3-1.48 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63337
    P
    		libct4-1.1.36-3.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63420
    P
    		djvulibre-3.5.27-9.28 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63492
    P
    		libreoffice-7.1.2.2-2.3 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63442
    P
    		libvorbis0-32bit-1.3.6-4.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63020
    P
    		libgit2-28-0.28.4-1.28 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62069
    P
    		emacs-25.3-3.6.51 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62263
    P
    		mozilla-nspr-32bit-4.25.1-3.17.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62157
    P
    		libidn-devel-1.34-3.2.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62353
    P
    		xdg-utils-1.1.3+20190413-1.24 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:59497
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:59492
    P
    		Security update for caribou (Important)
    2021-06-10
    oval:org.opensuse.security:def:59745
    P
    		Security update for libX11 (Important)
    2021-06-08
    oval:org.opensuse.security:def:60277
    P
    		Security update for MozillaFirefox (Important)
    2021-06-08
    oval:org.opensuse.security:def:63526
    P
    		NetworkManager-lang-1.10.6-3.16 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:60235
    P
    		Security update for ImageMagick (Moderate)
    2021-04-20
    oval:org.opensuse.security:def:60489
    P
    		Security update for tomcat (Important)
    2021-03-30
    oval:org.opensuse.security:def:59793
    P
    		Security update for openvswitch (Important)
    2021-02-03
    oval:org.opensuse.security:def:63154
    P
    		guestfs-data-1.38.0-3.52 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61796
    P
    		libXp-devel-1.0.3-1.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63248
    P
    		389-ds-1.4.3.9~git0.3eb8617f6-1.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63151
    P
    		gnuplot-5.2.2-1.109 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63286
    P
    		libxmltooling-devel-1.6.4-3.3.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61712
    P
    		cairo-devel-1.16.0-1.55 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63254
    P
    		apache2-mod_security2-2.9.2-1.34 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63387
    P
    		apache-commons-beanutils-1.9.2-2.46 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61883
    P
    		libsolv-devel-0.7.14-1.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62393
    P
    		accountsservice-0.6.45-4.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63389
    P
    		apache2-mod_php7-7.2.5-2.9 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62603
    P
    		sane-backends-1.0.27-4.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62922
    P
    		perl-YAML-LibYAML-0.59-1.16 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62485
    P
    		perl-MIME-Charset-1.012.2-1.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63052
    P
    		python2-numpy-gnu-hpc-1.14.0-4.5.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62699
    P
    		libsrt1-1.3.4-1.45 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:60872
    P
    		Security update for python-Twisted (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59978
    P
    		Security update for gdb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60726
    P
    		Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm (Important)
    2020-12-01
    oval:org.opensuse.security:def:59928
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:60963
    P
    		Security update for qemu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59066
    P
    		Security update for the Linux Kernel (Live Patch 28 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60046
    P
    		Security update for sqlite3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60913
    P
    		Security update for libssh2_org (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59067
    P
    		Security update for the Linux Kernel (Live Patch 29 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60992
    P
    		Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm (Important)
    2020-12-01
    oval:org.opensuse.security:def:59089
    P
    		Security update for spice (Important)
    2020-12-01
    oval:org.opensuse.security:def:59311
    P
    		Security update for libproxy (Important)
    2020-12-01
    oval:org.opensuse.security:def:60535
    P
    		rsyslog on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59245
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60571
    P
    		xf86-video-intel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59312
    P
    		Security update for freetype2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:60653
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:60609
    P
    		Security update for bzip2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:59334
    P
    		Security update for postgresql, postgresql96, postgresql10 and postgresql12 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60750
    P
    		Security update for xorg-x11-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59678
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:60698
    P
    		Security update for qemu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60834
    P
    		Security update for libzypp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60648
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:84445
    P
    		Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm (Important)
    2020-07-14
    oval:org.opensuse.security:def:83992
    P
    		Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm (Important)
    2020-07-14
    oval:org.opensuse.security:def:87993
    P
    		Security update for ardana-db, ardana-keystone, ardana-neutron, ardana-nova, crowbar-core, crowbar-openstack, crowbar-ui, openstack-barbican, openstack-heat-templates, openstack-keystone, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-sahara, python-psutil, release-notes-suse-openstack-cloud (Moderate)
    2019-11-26
    oval:org.opensuse.security:def:88297
    P
    		Security update for ardana-db, ardana-keystone, ardana-neutron, ardana-nova, crowbar-core, crowbar-openstack, crowbar-ui, openstack-barbican, openstack-heat-templates, openstack-keystone, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-sahara, python-psutil, release-notes-suse-openstack-cloud (Moderate)
    2019-11-26
    oval:com.ubuntu.disco:def:2019188740000000
    V
    		CVE-2019-18874 on Ubuntu 19.04 (disco) - medium.
    2019-11-12
    oval:com.ubuntu.bionic:def:2019188740000000
    V
    		CVE-2019-18874 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-11-12
    oval:com.ubuntu.xenial:def:2019188740000000
    V
    		CVE-2019-18874 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-11-12
    BACK
    psutil_project psutil *
    psutil_project psutil 5.6.5
    ibm spectrum protect plus 10.1.2
    ibm spectrum protect plus 10.1.5
    ibm spectrum protect plus 10.1.7
    ibm cloud pak for security 1.7.2.0