Resource exhaustion in Python - CVE-2024-12254

Vulnerability identifier: #VU101386

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-12254

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in asyncio._SelectorSocketTransport.writelines(). A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Python
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Python 3 Module
openSUSE Leap
Ubuntu
Fedora
Rapid Infrastructure Automation
Guardium Data Security Center (GDSC)
Splunk User Behavior Analytics (UBA)
python3.12 (Red Hat package)
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
python3.12
python312-base-64bit
libpython3_12-1_0-32bit-debuginfo
libpython3_12-1_0-32bit
python312-base-32bit-debuginfo
python312-32bit-debuginfo
python312-base-32bit
python312-64bit-debuginfo
libpython3_12-1_0-64bit-debuginfo
python312-64bit
python312-idle
python312-base-64bit-debuginfo
libpython3_12-1_0-64bit
python312-dbm-debuginfo
libpython3_12-1_0-debuginfo
python312-tools
python312-doc-devhelp
python312-tk
python312-core-debugsource
python312-32bit
python312-base
python312-curses
python312-testsuite-debuginfo
python312-debugsource
libpython3_12-1_0
python312-tk-debuginfo
python312-testsuite
python312
python312-curses-debuginfo
python312-doc
python312-base-debuginfo
python312-dbm
python312-debuginfo
python312-devel
python3.13
python3.14

Install updates from vendor's website.

Rapid Infrastructure Automation - update to 1.1.5.3
Guardium Data Security Center (GDSC) - update to 3.7.2
Splunk User Behavior Analytics (UBA) - update to 5.4.3
python3.12 (Red Hat package) - addressed in versions 3.12.1-4.el9_4.5, 3.12.5-2.el9_5.2, 3.12.8-1.el8_10
python3.12-minimal (Ubuntu package) - addressed in versions 3.12.3-1ubuntu0.4, 3.12.7-1ubuntu1.1
python3.12 (Ubuntu package) - addressed in versions 3.12.3-1ubuntu0.4, 3.12.7-1ubuntu1.1
python3.12 - addressed in versions 3.12.8-2.fc41, 3.12.8-2.fc42
python312-base-64bit - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
libpython3_12-1_0-32bit-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
libpython3_12-1_0-32bit - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-base-32bit-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-32bit-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-base-32bit - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-64bit-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
libpython3_12-1_0-64bit-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-64bit - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-idle - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-base-64bit-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
libpython3_12-1_0-64bit - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-dbm-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
libpython3_12-1_0-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-tools - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-doc-devhelp - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-tk - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-core-debugsource - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-32bit - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-base - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-curses - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-testsuite-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-debugsource - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
libpython3_12-1_0 - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-tk-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-testsuite - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312 - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-curses-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-doc - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-base-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-dbm - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-debuginfo - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python312-devel - addressed in versions 3.12.8-150600.3.12.1, 3.12.9-150600.3.18.1
python3.13 - update to 3.13.1-2.fc42
python3.14 - addressed in versions 3.14.0~a2-2.fc40, 3.14.0~a2-2.fc41, 3.14.0~a2-2.fc42

• http://www.openwall.com/lists/oss-security/2024/12/06/1
• https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82
• https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5
• https://github.com/python/cpython/issues/127655
• https://github.com/python/cpython/pull/127656
• https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/

• Denial of service in Python
• Fedora 42 update for python3.12
• Fedora 41 update for python3.12
• Fedora 42 update for python3.14
• Fedora 40 update for python3.14
• Fedora 41 update for python3.14
• Fedora 42 update for python3.13
• SUSE update for python312
• Red Hat Enterprise Linux 9 update for python3.12
• Red Hat Enterprise Linux 8 update for python3.12
• Red Hat Enterprise Linux 9 update for python3.12
• Ubuntu update for python3.12
• SUSE update for python312
• Multiple vulnerabilities in IBM Rapid Infrastructure Automation
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Splunk User Behavior Analytics (UBA) update for third-party components