Security Bulletin: Security vulnerability affects IBM Cloud Object Storage SDK Python (January 2020 Bulletin)

Summary

Security vulnerability affects IBM Cloud Object Storage SDK Python. The vulnerability has been addressed in the latest SDK 2.6.0 release.

Vulnerability Details

CVE-ID: CVE-2019-18874
Description: psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
CVSS Base Score: 5.3
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/171612 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

<https://github.com/IBM/ibm-cos-sdk-python/tree/2.6.0&gt;

Workarounds and Mitigations

<https://github.com/IBM/ibm-cos-sdk-python/tree/2.6.0&gt;