Unbounded memory buffering in SelectorSocketTransport.writelines()

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

N/A

未加控制的资源消耗(资源穷尽)

Python 安全漏洞

Python是Python基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。 Python 3.12.0及之后版本存在安全漏洞，该漏洞源于asyncio._SelectorSocketTransport.writelines方法不会在写入缓冲区达到high-water mark时暂停写入,也不会通知Protocol排空缓冲区，这可能导致内存耗尽。

N/A

N/A