CVE-2024-3219

Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection

Summary

Original description

The description as published by the source.

The
“socket” module provides a pure-Python fallback to the
socket.socketpair() function for platforms that don’t support AF_UNIX,
such as Windows. This pure-Python implementation uses AF_INET or
AF_INET6 to create a local connected pair of sockets. The connection
between the two sockets was not verified before passing the two sockets
back to the user, which leaves the server socket vulnerable to a
connection race from a malicious local peer.

Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory mail.python.org
advisory nvd.nist.gov
advisory security.netapp.com
package github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
report github.com
web openwall.com