Critical Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
ALSA-2024:10978: Important: python3.12 security update. Affects python3.12 versions < 3.12.5-2.el9_5.2. Fixed in 3.12.5-2.el9_5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could impact the security and performance of applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include issues with virtual environment activation scripts that do not properly quote paths (CVE-2024-9287) and unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254). These vulnerabilities can lead to potential security risks such as code injection and denial of service due to excessive memory consumption, which could compromise the integrity and availability of applications using this version.
How To Fix
Minimum fixed version
3.12.5-2.el9_5.2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of virtual environments until the update is applied. Additionally, monitor memory usage in applications that utilize SelectorSocketTransport to prevent potential crashes.
Conclusion
In summary, Python 3.12 has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to maintain the security and performance of applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include improper quoting of paths in virtual environment activation scripts and unbounded memory buffering in SelectorSocketTransport.writelines().
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
These vulnerabilities can lead to security risks such as code injection and denial of service due to excessive memory consumption, affecting the integrity and availability of applications.
While the best solution is to update to the patched version, you can temporarily avoid using virtual environments and monitor memory usage in your applications.
For more details, refer to the CVE pages for CVE-2024-9287 and CVE-2024-12254, which provide in-depth information about the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
