mirror of https://github.com/bitnami/vulndb.git
Update 20250206121645 (#766)
feat: Updated at 20250206121645 Signed-off-by: bitnami-bot <bitnami-bot@vmware.com>
This commit is contained in:
Bitnami Bot
GitHub
parent
d8693a445b
commit
32937f58e8
|
|
@ -0,0 +1,80 @@
|
|||
{
|
||||
"schema_version": "1.5.0",
|
||||
"id": "BIT-python-min-2024-12254",
|
||||
"details": "Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not \"pause\" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the \"high-water mark\". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.",
|
||||
"aliases": [
|
||||
"CVE-2024-12254"
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Bitnami",
|
||||
"name": "python-min",
|
||||
"purl": "pkg:bitnami/python-min"
|
||||
},
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.12.0"
|
||||
},
|
||||
{
|
||||
"fixed": "3.12.9"
|
||||
},
|
||||
{
|
||||
"introduced": "3.13.0"
|
||||
},
|
||||
{
|
||||
"fixed": "3.13.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"severity": "High",
|
||||
"cpes": [
|
||||
"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
|
||||
]
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/issues/127655"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/pull/127656"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2024/12/06/1"
|
||||
}
|
||||
],
|
||||
"published": "2025-02-06T12:33:16.877Z",
|
||||
"modified": "2025-02-06T12:53:47.047Z"
|
||||
}
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
{
|
||||
"schema_version": "1.5.0",
|
||||
"id": "BIT-python-2024-12254",
|
||||
"details": "Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not \"pause\" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the \"high-water mark\". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.",
|
||||
"aliases": [
|
||||
"CVE-2024-12254"
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Bitnami",
|
||||
"name": "python",
|
||||
"purl": "pkg:bitnami/python"
|
||||
},
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.12.0"
|
||||
},
|
||||
{
|
||||
"fixed": "3.12.9"
|
||||
},
|
||||
{
|
||||
"introduced": "3.13.0"
|
||||
},
|
||||
{
|
||||
"fixed": "3.13.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"severity": "High",
|
||||
"cpes": [
|
||||
"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
|
||||
]
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/issues/127655"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/python/cpython/pull/127656"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2024/12/06/1"
|
||||
}
|
||||
],
|
||||
"published": "2025-02-06T12:33:19.896Z",
|
||||
"modified": "2025-02-06T12:53:47.047Z"
|
||||
}
|
||||
Loading…
Reference in New Issue