CVE-2024-12254

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
 method would not "pause" writing and signal to the Protocol to drain 
the buffer to the wire once the write buffer reached the "high-water 
mark". Because of this, Protocols would not periodically drain the write
 buffer potentially leading to memory exhaustion.





This
 vulnerability likely impacts a small number of users, you must be using
 Python 3.12.0 or later, on macOS or Linux, using the asyncio module 
with protocols, and using .writelines() method which had new 
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of 
these factors are true then your usage of Python is unaffected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
PSFCNA
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
Debian logo
Debian Releases
Debian Product
Codename
python3.11
bookworm
3.11.2-6+deb12u6
fixed
bookworm (security)
3.11.2-6+deb12u3
fixed
python3.12
sid
3.12.10-1
fixed
python3.13
trixie
3.13.3-2
fixed
sid
3.13.3-4
fixed
python3.9
bullseye
3.9.2-1
fixed
bullseye (security)
3.9.2-1+deb11u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python2.7
plucky
dne
oracular
dne
noble
dne
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
trusty
not-affected
python3.10
plucky
dne
oracular
dne
noble
dne
jammy
not-affected
focal
dne
bionic
dne
xenial
dne
trusty
dne
python3.11
plucky
dne
oracular
dne
noble
dne
jammy
not-affected
focal
dne
bionic
dne
xenial
dne
trusty
dne
python3.12
plucky
dne
oracular
Fixed 3.12.7-1ubuntu1.1
released
noble
Fixed 3.12.3-1ubuntu0.4
released
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
python3.13
plucky
not-affected
oracular
needs-triage
noble
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
python3.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
not-affected
python3.5
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
dne
xenial
not-affected
trusty
not-affected
python3.6
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
not-affected
xenial
dne
trusty
dne
python3.7
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
not-affected
xenial
dne
trusty
dne
python3.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
not-affected
bionic
not-affected
xenial
dne
trusty
dne
python3.9
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
not-affected
bionic
dne
xenial
dne
trusty
dne