Critical Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
RLSA-2024:10978: Important: python3.12 security update. Affects python3.12 versions < 0:3.12.5-2.el9_5.2. Fixed in 0:3.12.5-2.el9_5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include an issue with virtual environment activation scripts not quoting paths (CVE-2024-9287) and unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254). These vulnerabilities can lead to potential security risks, including path traversal attacks and denial of service due to excessive memory consumption.
How To Fix
Minimum fixed version
0:3.12.5-2.el9_5.2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, Python 3.12 has critical vulnerabilities that need to be addressed promptly to ensure the security of applications. Updating to the latest patched version is essential to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include unquoted paths in virtual environment activation scripts and unbounded memory buffering in SelectorSocketTransport.writelines().
These vulnerabilities can lead to security risks such as path traversal attacks and denial of service due to excessive memory usage.
Yes, a patch is available in version 3.12.5-2.el9_5.2. It is recommended to update to this version.
You can update Python 3.12 by running the command 'sudo dnf update python3.12' in your terminal.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
