Critical Resource Consumption Vulnerability in Python 3.12
Summary
RLSA-2025:3631: Low: python3.12 security update. Affects python3.12 versions < 0:3.12.5-2.el9_5.3. Fixed in 0:3.12.5-2.el9_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic data types, modules, classes, and exceptions, making it a versatile choice for developers. However, it is susceptible to vulnerabilities that can impact its performance and security, such as the one identified in the http.cookies module.
Vulnerability Detail
The vulnerability, identified as CVE-2024-7592, arises from uncontrolled CPU resource consumption when using the http.cookies module in Python 3.12. This can lead to significant performance degradation, potentially causing denial-of-service conditions. Attackers could exploit this vulnerability to consume excessive CPU resources, affecting the availability of applications relying on this module. The CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:3.12.5-2.el9_5.3
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the use of the http.cookies module in your applications until the update is applied. Additionally, consider implementing resource monitoring to detect unusual CPU usage patterns.
Conclusion
The vulnerability CVE-2024-7592 in Python 3.12 poses a risk of uncontrolled CPU resource consumption through the http.cookies module. It is crucial to update to the patched version to ensure the security and performance of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2024-7592 is a vulnerability in Python 3.12 that allows for uncontrolled CPU resource consumption when using the http.cookies module.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The vulnerability can lead to excessive CPU usage, resulting in degraded performance or denial-of-service conditions for applications using the affected module.
Yes, a patch is available in version 0:3.12.5-2.el9_5.3 of Python 3.12. Updating to this version will mitigate the vulnerability.
You can update Python 3.12 by running the command 'sudo dnf update python3.12' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
