psutil (aka python-psutil) through 5.6.5 can have a double free.
Priority LOW 39CWE-415Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-415 and the CVSS impact.
Summary
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Why it matters now
EPSS 0.03522 89th percentileScored 2026-11-07
Fix Partial psutil (PyPI): 5.6.6Red Hat: 10 advisoriesRed Hat: 13 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | psutil (PyPI) | before 5.6.6 | 5.6.6 | Patch available | GHSA-qfc5-mcwq-26q8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- psutil (PyPI) Vendor— Affected before 5.6.6 Fixed in 5.6.6 Patch available GHSA-qfc5-mcwq-26q8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:psutil_project:psutil:*:*:*:*:*:*:*:* | up to 5.6.5 | Vulnerable | Psutil Project |
- cpe:2.3:a:psutil_project:psutil:*:*:*:*:*:*:*:* Versions up to 5.6.5 Vulnerable ·Psutil Project
Remediation
- Fix · GHSA-qfc5-mcwq-26q8 psutil (PyPI) Fixed in 5.6.6 Advisory →
Red Hat 10 advisories
- RHSA-2021:4324 Released 2021-11-09 · Red Hat rating Moderatepython-psutil security update
- Red Hat Enterprise Linux AppStream (v. 8) python-psutil-5.4.3-11.el8, python3-psutil-5.4.3-11.el8
- RHSA-2021:4162 Released 2021-11-09 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- RHSA-2021:1313 Released 2021-04-21 · Red Hat rating ModerateSatellite 6.9 Release
- Red Hat Satellite 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
- Red Hat Satellite Capsule 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
Show 7 more Red Hat advisories
- RHSA-2020:5249 Released 2020-11-30 · Red Hat rating Moderatesecurity update - Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container
- Red Hat Ansible Tower 3.7 for RHEL 7 ansible-tower-37/ansible-tower-rhel7
- RHSA-2020:4299 Released 2020-10-20 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- RHSA-2020:4255 Released 2020-10-14 · Red Hat rating Moderatesecurity update - Red Hat Ansible Tower 3.6 runner release (CVE-2019-18874)
- Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-runner-rhel7
- RHSA-2020:4254 Released 2020-10-14 · Red Hat rating Moderatesecurity update - Red Hat Ansible Tower 3.7 runner release (CVE-2019-18874)
- Red Hat Ansible Tower 3.7 for RHEL 7 ansible-tower-37/ansible-runner-rhel7
- RHSA-2020:2593 Released 2020-07-01 · Red Hat rating ModerateOpenShift Container Platform 4.2.36 python-psutil security update
- Red Hat OpenShift Container Platform 4.2 python-psutil-5.6.6-1.el7ar, python2-psutil-5.6.6-1.el7ar
- RHSA-2020:2635 Released 2020-06-23 · Red Hat rating ModerateOpenShift Container Platform 4.3.26 python-psutil security update
- Red Hat OpenShift Container Platform 4.3 python-psutil-5.6.6-1.el7ar, python2-psutil-5.6.6-1.el7ar
- RHSA-2020:2583 Released 2020-06-22 · Red Hat rating ModerateOpenShift Container Platform 4.4.9 python-psutil security update
- Red Hat OpenShift Container Platform 4.4 python-psutil-5.6.6-1.el7ar, python2-psutil-5.6.6-1.el7ar
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 15 (Stein) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Ansible Tower 3.6 for RHEL 7 | Fixed | RHSA-2020:4255 |
| Red Hat Ansible Tower 3.7 for RHEL 7 | Fixed | RHSA-2020:4254, RHSA-2020:5249 |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4162 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4162, RHSA-2021:4324 |
| Red Hat OpenShift Container Platform 4.2 | Fixed | RHSA-2020:2593 |
| Red Hat OpenShift Container Platform 4.3 | Fixed | RHSA-2020:2635 |
| Red Hat OpenShift Container Platform 4.4 | Fixed | RHSA-2020:2583 |
| Red Hat Satellite 6.9 | Fixed | RHSA-2021:1313 |
| Red Hat Satellite Capsule 6.9 | Fixed | RHSA-2021:1313 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4299 |
Not affected: 3 products
- Red Hat Enterprise Linux 9
- Red Hat Satellite 6.9
- Red Hat Satellite Capsule 6.9
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18874
- 2026-10-03 Alias added: GHSA-qfc5-mcwq-26q8
References
Advisory 6
Other 8
- [debian-lts-announce] 20191118 [SECURITY] [DLA 1998-1] python-psutil security update
- https://github.com/giampaolo/psutil/commit/7d512c8e4442a896d56505be3e78f1156f443465
- https://github.com/giampaolo/psutil
- https://github.com/giampaolo/psutil/blob/master/HISTORY.rst#566
- https://github.com/pypa/advisory-database/tree/main/vulns/psutil/PYSEC-2019-41.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OLETTJYZL2SMBUI4Q2NGBMGPDPP54SRG
- https://usn.ubuntu.com/4204-1
Sources
- CVE-2019-18874 · CVE Program
- CVE-2019-18874 · NVD
- FIRST EPSS
- GHSA-qfc5-mcwq-26q8 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-18874 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences