Skip to content
Fencer Vulns
critical 9.8

CVE-2023-41419 json

Gevent allows remote attacker to escalate privileges

published 2023-09-25 3 y ago modified 2026-09-10 1 mo ago also GHSA-x7m3-jprg-wc5g , PYSEC-2023-177 , EUVD-2023-0084

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.

Patch / fix

  • pypi gevent 23.9.0
  • gevent gevent 23.9.0
  • python-gevent Debian 14, Debian 13 23.9.1-0.1

debian advisories DEBIAN-CVE-2023-41419

  • python-gevent RHEL 8 1.2.2-5.el8_10
  • python3-gevent RHEL 8 1.2.2-5.el8_10
  • python-gevent openstack 17.1 21.1.2-2.el9ost
  • python3-gevent openstack 17.1 21.1.2-2.el9ost
  • python-gevent RHEL 8.8 EUS 1.2.2-5.el8_8
  • python3-gevent RHEL 8.8 EUS 1.2.2-5.el8_8
  • python-gevent RHEL 8.4 TUS, RHEL 8.4 E4S, RHEL 8.4 AUS 1.2.2-5.el8_4
  • python3-gevent RHEL 8.4 TUS, RHEL 8.4 E4S, RHEL 8.4 AUS 1.2.2-5.el8_4

red hat advisories RHSA-2024:8834RHSA-2024:8102RHSA-2024:8105RHSA-2024:7785RHSA-2024:7421RHSA-2023:7438

  • python-gevent SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +12 more 1.2.2-150000.5.3.1
  • python-gevent OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.1.2-3.3.1
  • python-gevent OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.3.5-3.3.1

suse advisories SUSE-SU-2023:4091-1SUSE-SU-2023:4009-1SUSE-SU-2023:3975-1

  • python3-gevent AlmaLinux 8 1.2.2-5.el8_10

almalinux advisories ALSA-2024:8834

  • python-gevent Rocky Linux 8 1.2.2-5.el8

rocky linux advisories RLSA-2024:8834

  • python-gevent CBL-Mariner 2.0 1.3.6-9

azure linux advisories AZL-30058

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-41419 updated cvss 9.1

python-gevent: privilege escalation via a crafted script to the WSGIServer component

  • Red Hat Enterprise Linux 7 python-gevent Red Hat OpenShift Container Platform 4 python-gevent Red Hat OpenStack Platform 17.0 python3-gevent Red Hat OpenStack Platform 18.0 python-gevent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) python-gevent 1.2.2-5.el8_10, python3-gevent 1.2.2-5.el8_10
    fixed: vendor fix RHSA-2024:8834
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) python-gevent 1.2.2-5.el8_2, python3-gevent 1.2.2-5.el8_2
    fixed: vendor fix RHSA-2024:7785
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) python-gevent 1.2.2-5.el8_4, python3-gevent 1.2.2-5.el8_4
    fixed: vendor fix RHSA-2024:8105
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) python-gevent 1.2.2-5.el8_6, python3-gevent 1.2.2-5.el8_6
    fixed: vendor fix RHSA-2024:7421
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) python-gevent 1.2.2-5.el8_4, python3-gevent 1.2.2-5.el8_4
    fixed: vendor fix RHSA-2024:8105
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) python-gevent 1.2.2-5.el8_6, python3-gevent 1.2.2-5.el8_6
    fixed: vendor fix RHSA-2024:7421
show 5 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) python-gevent 1.2.2-5.el8_8, python3-gevent 1.2.2-5.el8_8
    fixed: vendor fix RHSA-2024:8102
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) python-gevent 1.2.2-5.el8_4, python3-gevent 1.2.2-5.el8_4
    fixed: vendor fix RHSA-2024:8105
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) python-gevent 1.2.2-5.el8_6, python3-gevent 1.2.2-5.el8_6
    fixed: vendor fix RHSA-2024:7421
  • Red Hat OpenStack Platform 17.1 python-gevent 21.1.2-2.el9ost, python3-gevent 21.1.2-2.el9ost
    fixed: vendor fix RHSA-2023:7438
  • Red Hat OpenStack Platform 16.1 python-gevent Red Hat OpenStack Platform 16.2 python-gevent
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/gevent/gevent/issues/1989 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi gevent
<23.9.0
23.9.0

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.