CVE-2024-12254
highPriorität · verfolgen · 1EPSS 0.019 · 79. PerzentilDEEURUUSEPSS · bewertet 2026-10-24
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.6–8.7
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (30)
Betroffene Produkte und Versionsbereiche.
- NetApp ActiveIQ Unified Manager for Microsoft Windowsalle Versionencert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-3630Python: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-12-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-libpython-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()2025-08-11vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- BIT-python-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()2025-02-06vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- BIT-python-min-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()2025-02-06vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- PSF-2024-142024-12-06vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202412-639cnnvd
- EUVD-2024-50718enisa_euvd
- BDU:2025-00345fstec_bdu
- GHSA-ph84-rcj2-fxxmenisa_euvd
- BIT-libpython-2024-12254osv
- BIT-python-2024-12254osv
- BIT-python-min-2024-12254osv
- PSF-2024-14osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (23)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2024/12/06/1cnnvd
- https://access.redhat.com/security/cve/cve-2024-12254cnnvd
- https://github.com/python/cpythonPatchcnnvd
- https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82cnnvd
- https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5cnnvd
- https://github.com/python/cpython/issues/127655cnnvd
- https://github.com/python/cpython/pull/127656cnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan