CVE-2023-25399: 
Python vulnerability analysis and mitigation

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. This vulnerability has been assigned CVE-2023-25399 and is disputed as a bug rather than a vulnerability, as SciPy is not designed to be exposed to untrusted users or data directly (NVD).

The vulnerability stems from a memory management issue in the Py_FindObjects() function where a new reference is returned and assigned to a tuple variable but goes out of scope without decreasing the reference count. The issue has a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Ubuntu).

The vulnerability could potentially lead to memory leaks in the system, which might result in a denial of service condition. However, since SciPy is not designed for exposure to untrusted users or data, the real-world impact is considered limited (NVD).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is required for exploitation. There are no known reports of this vulnerability being exploited in the wild (Ubuntu).

The issue has been fixed in various Ubuntu releases: Ubuntu 22.10 (1.8.1-10ubuntu0.22.10.1), Ubuntu 22.04 LTS (1.8.0-1exp2ubuntu1+esm1), and Ubuntu 20.04 LTS (1.3.3-3ubuntu0.1~esm1). Users are advised to update their systems to these patched versions (Ubuntu Security Notice).