5.3
Medium
CVE-2024-9979 Pyo3: risk of use-after-free in `borrowed` reads from python weak references
Description
A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak Python references.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitable with local access to the machine, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2318646 bugzilla.redhat.com
- crates.io crates.io
- github.com github.com
- rustsec.org rustsec.org
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2
The 211 CVEs of Red Hat Ansible Automation Platform 2 →
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Medium
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
5.4
Medium
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
High