CVE-2024-12254

CVE Details

Release Date:

2024-12-06

Description

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()\nmethod would not 'pause' writing and signal to the Protocol to drain \nthe buffer to the wire once the write buffer reached the 'high-water \nmark'. Because of this, Protocols would not periodically drain the write\nbuffer potentially leading to memory exhaustion.\nThis\nvulnerability likely impacts a small number of users, you must be using\nPython 3.12.0 or later, on macOS or Linux, using the asyncio module \nwith protocols, and using .writelines() method which had new \nzero-copy-on-write behavior in Python 3.12.0 and later. If not all of \nthese factors are true then your usage of Python is unaffected.

See more information about CVE-2024-12254 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.5
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality:	None
Integrity:	None
Availability:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (python3.12)	ELSA-2024-10980	2024-12-12
Oracle Linux version 9 (python3.12)	ELSA-2024-10978	2024-12-12