CVE-2024-3219

Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The
“socket” module provides a pure-Python fallback to the
socket.socketpair() function for platforms that don’t support AF_UNIX,
such as Windows. This pure-Python implementation uses AF_INET or
AF_INET6 to create a local connected pair of sockets. The connection
between the two sockets was not verified before passing the two sockets
back to the user, which leaves the server socket vulnerable to a
connection race from a malicious local peer.

Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

参照URL

advisory github.com
advisory mail.python.org
advisory nvd.nist.gov
advisory security.netapp.com
package github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
report github.com
web openwall.com