Critical Resource Consumption Vulnerability in Python 3.12 - Security Update Required
Summary
ALSA-2025:3631: Low: python3.12 security update. Affects python3.12 versions < 3.12.5-2.el9_5.3. Fixed in 3.12.5-2.el9_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports dynamic data types and dynamic typing. It includes modules, classes, exceptions, and interfaces to various system calls and libraries. This version is widely used for developing applications across different domains due to its versatility and ease of use. However, it has been identified to have a vulnerability that can lead to uncontrolled CPU resource consumption, particularly when using the http.cookies module.
Vulnerability Detail
The vulnerability, identified as CVE-2024-7592, arises from an uncontrolled CPU resource consumption issue in the http.cookies module of Python 3.12. This can potentially lead to denial of service (DoS) conditions, where the application may become unresponsive due to excessive resource usage. The vulnerability is critical as it can be exploited by attackers to disrupt services, affecting the availability of applications that rely on Python 3.12.
How To Fix
Minimum fixed version
3.12.5-2.el9_5.3
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the resource usage of the application or implementing rate limiting on requests that utilize the http.cookies module. This can help mitigate the impact of the vulnerability until the package is updated.
Conclusion
In summary, the vulnerability CVE-2024-7592 in Python 3.12 poses a significant risk due to uncontrolled CPU resource consumption. It is crucial to update to the patched version 3.12.5-2.el9_5.3 to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2024-7592 is a vulnerability in Python 3.12 that allows for uncontrolled CPU resource consumption, potentially leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability can lead to service disruptions, making applications unresponsive and affecting user experience.
Yes, you should update to version 3.12.5-2.el9_5.3 to ensure that the vulnerability is patched.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
