Vulnerability · Published Sep 25, 2023 · Assigned by mitre
CVE-2023-41419
Critical 9.8
In plain English
A critical-severity security flaw in the python3-gevent package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.8%top 21.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python3-gevent | 1.2.2-5.el8_10 | ALSA-2024:8834 |
| Debian:12 | python-gevent | no fix listed | DEBIAN-CVE-2023-41419 |
| Debian:13 | python-gevent | 23.9.1-0.1 | DEBIAN-CVE-2023-41419 |
| Debian:14 | python-gevent | 23.9.1-0.1 | DEBIAN-CVE-2023-41419 |
| PyPI | gevent | 23.9.0 | GHSA-x7m3-jprg-wc5g |
| PyPI | gevent | 23.9.0 | PYSEC-2023-177 |
| Rocky Linux:8 | python-gevent | 0:1.2.2-5.el8 | RLSA-2024:8834 |
| Ubuntu:22.04:LTS | python-gevent | no fix listed | UBUNTU-CVE-2023-41419 |