Input validation error in Python - CVE-2010-3492
Published: October 29, 2019 / Updated: June 3, 2025
Vulnerability identifier: #VU110150
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2010-3492
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.
Affected software
Python
Gentoo Linux
dev-lang/python
Gentoo Linux
dev-lang/python
How to mitigate CVE-2010-3492
Install update from vendor's website.
Python - update to 3.2
dev-lang/python - update to 3.3.2-r1
dev-lang/python - update to 3.3.2-r1
External References
- http://bugs.python.org/issue6706
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:215
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:216
- http://www.openwall.com/lists/oss-security/2010/09/09/6
- http://www.openwall.com/lists/oss-security/2010/09/11/2
- http://www.openwall.com/lists/oss-security/2010/09/22/3
- http://www.openwall.com/lists/oss-security/2010/09/24/3
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12111