It was discovered that there were multiple double free vulnerabilities in python-psutil, a Python module providing convenience functions for accessing system process data.

This was caused by incorrect reference counting handling within for/while loops that convert system data into said Python objects.

For Debian 8 'Jessie', this issue has been fixed in python-psutil version 2.1.1-1+deb8u1.

We recommend that you upgrade your python-psutil packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0186 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2019-18874:
      psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4204-1 advisory.

    Riccardo Schirone discovered that psutil incorrectly handled certain reference counting operations. An     attacker could use this issue to cause psutil to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2635 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * python-psutil: double free because of refcount mishandling (CVE-2019-18874)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4162 advisory.

  - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before     3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and     urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query     parameters using a semicolon (;), they can cause a difference in the interpretation of the request between     the proxy (running with default configuration) and the server. This can result in malicious requests being     cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and     therefore would not include it in a cache key of an unkeyed parameter. (CVE-2021-23336)

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

  - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing     serialized Python objects) via directory traversal, leading to code execution. (CVE-2021-42771)

  - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote     attacker could possibly use this issue to install a different revision on a repository. The highest threat     from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131137	Debian DLA-1998-1 : python-psutil security update	Nessus	Debian Local Security Checks	2019/11/20	2024/4/11	high
239488	TencentOS Server 3: python-psutil (TSSA-2022:0186)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	high
131560	Ubuntu 16.04 LTS / 18.04 LTS : psutil vulnerability (USN-4204-1)	Nessus	Ubuntu Local Security Checks	2019/12/3	2024/8/27	high
137756	RHEL 7 : OpenShift Container Platform 4.3.26 python-psutil (RHSA-2020:2635)	Nessus	Red Hat Local Security Checks	2020/6/24	2024/11/7	high
155969	Oracle Linux 8 : python38:3.8 / and / python38-devel:3.8 (ELSA-2021-4162)	Nessus	Oracle Linux Local Security Checks	2021/12/10	2025/9/23	high

检测

插件搜索

high

high

high

high

high