Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-3219— Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection

AI Predicted 5.3 Difficulty: Hard EPSS 0.25% · P16

Possible ATT&CK Techniques 1AI

T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-3219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection
Source: CVE Program / CVE List V5
Vulnerability Description
The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
CPython 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CPython是Python基金会的一个用C语言实现的Python解释器。 CPython存在安全漏洞，该漏洞源于服务器套接字容易受到来自恶意本地对等方的连接竞争。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Python Software FoundationCPython 0 ~ 3.8.20 -

II. Public POCs for CVE-2024-3219

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-3219

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-3219 (15)

Mailing List Discussions for CVE-2024-3219 (1)

Other References for CVE-2024-3219 (2)

IV. Related Vulnerabilities

Same product: CPython
Same vendor: Python Software Foundation

V. Comments for CVE-2024-3219

No comments yet

Leave a comment