CVE - CVE-2024-12254

CVE-ID
CVE-2024-12254	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82 URL:https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82 MISC:https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5 URL:https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5 MISC:https://github.com/python/cpython/issues/127655 URL:https://github.com/python/cpython/issues/127655 MISC:https://github.com/python/cpython/pull/127656 URL:https://github.com/python/cpython/pull/127656 MISC:https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/ URL:https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/
Assigning CNA
Python Software Foundation
Date Record Created
20241205	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241205)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)