Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-808 advisory.

    Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()method would not pause     writing and signal to the Protocol to drainthe buffer to the wire once the write buffer reached the high-     watermark. Because of this, Protocols would not periodically drain the writebuffer potentially leading to     memory exhaustion.





    Thisvulnerability likely impacts a small number of users, you must be usingPython 3.12.0 or later, on     macOS or Linux, using the asyncio modulewith protocols, and using .writelines() method which had newzero-     copy-on-write behavior in Python 3.12.0 and later. If not all ofthese factors are true then your usage of     Python is unaffected. (CVE-2024-12254)

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7219-1 advisory.

    It was discovered that Python incorrectly handled asyncio write buffers. A remote attacker could possibly     use this issue to cause Python to consume memory, leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-82a696ca59 advisory.

    Update to 3.12.8




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-3c18fe0d93 advisory.

    This is the first maintenance release of Python 3.13     ====================================================

    Python 3.13 is the newest major release of the Python programming language, and it contains many new     features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing     almost 400 bugfixes, build improvements and documentation changes since 3.13.0.

    Security content in this release
    --------------------------------

    -   [gh-122792](https://github.com/python/cpython/issues/122792): Changed IPv4-mapped     `ipaddress.IPv6Address` to consistently use the mapped IPv4 address value for deciding properties.
    Properties which have their behavior fixed are `is_multicast`, `is_reserved`, `is_link_local`,     `is_global`, and `is_unspecified`.
    -   CVE-2024-9287: [gh-124651](https://github.com/python/cpython/issues/124651): Properly quote template     strings in `venv` activation scripts.
    -   [gh-125140](https://github.com/python/cpython/issues/125140): Remove the current directory from     sys.path when using PyREPL.
    - CVE-2024-12254: Unbounded memory buffering in `SelectorSocketTransport.writelines()` fixed.

    libdnf and libcomps fixes     ====================

    - Fix segfaults in iterators (Python 3.13.1 made this crash happen in regular usage)






Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-be6ea1ce44 advisory.

    This is the first maintenance release of Python 3.13     ====================================================

    Python 3.13 is the newest major release of the Python programming language, and it contains many new     features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing     almost 400 bugfixes, build improvements and documentation changes since 3.13.0.

    Security content in this release
    --------------------------------

    -   [gh-122792](https://github.com/python/cpython/issues/122792): Changed IPv4-mapped     `ipaddress.IPv6Address` to consistently use the mapped IPv4 address value for deciding properties.
    Properties which have their behavior fixed are `is_multicast`, `is_reserved`, `is_link_local`,     `is_global`, and `is_unspecified`.
    -   CVE-2024-9287: [gh-124651](https://github.com/python/cpython/issues/124651): Properly quote template     strings in `venv` activation scripts.
    -   [gh-125140](https://github.com/python/cpython/issues/125140): Remove the current directory from     sys.path when using PyREPL.
    - CVE-2024-12254: Unbounded memory buffering in `SelectorSocketTransport.writelines()` fixed.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-54aa5fc4b2 advisory.

    Security fix for CVE-2024-12254

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10980 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:10980 advisory.

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
      * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:11035 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4291-1 advisory.

    - CVE-2024-12254: Fixed unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290)

    Other fixes:
    - Updated to version 3.12.8
    - Remove -IVendor/ from python-config (bsc#1231795)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10980 advisory.

    [3.12.8-1]
    - Update to 3.12.8
    - Security fix for CVE-2024-9287 and CVE-2024-12254     Resolves: RHEL-64880, RHEL-70315

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10978 advisory.

    [3.12.5-2.2]
    - Security fix for CVE-2024-9287 and CVE-2024-12254     Resolves: RHEL-64885, RHEL-70316

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10978 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10980 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

    * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b2cebcbb49 advisory.

    Security fix for CVE-2024-12254

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-340a4bdc5d advisory.

    Security fix for CVE-2024-12254

    ----

    Update to 3.12.8


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214617	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-808)	Nessus	Amazon Linux Local Security Checks	high
214443	Ubuntu 24.04 LTS / 24.10 : Python vulnerability (USN-7219-1)	Nessus	Ubuntu Local Security Checks	high
213381	Fedora 40 : python3-docs / python3.12 (2024-82a696ca59)	Nessus	Fedora Local Security Checks	high
213323	Fedora 41 : libcomps / libdnf / python3-docs / python3.13 (2024-3c18fe0d93)	Nessus	Fedora Local Security Checks	high
213239	Fedora 40 : python3.13 (2024-be6ea1ce44)	Nessus	Fedora Local Security Checks	high
213235	Fedora 41 : python3.14 (2024-54aa5fc4b2)	Nessus	Fedora Local Security Checks	high
213221	RockyLinux 8 : python3.12 (RLSA-2024:10980)	Nessus	Rocky Linux Local Security Checks	high
213178	AlmaLinux 8 : python3.12 (ALSA-2024:10980)	Nessus	Alma Linux Local Security Checks	high
212760	RHEL 9 : python3.12 (RHSA-2024:11035)	Nessus	Red Hat Local Security Checks	high
212738	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2024:4291-1)	Nessus	SuSE Local Security Checks	high
212715	Oracle Linux 8 : python3.12 (ELSA-2024-10980)	Nessus	Oracle Linux Local Security Checks	high
212714	Oracle Linux 9 : python3.12 (ELSA-2024-10978)	Nessus	Oracle Linux Local Security Checks	high
212679	RHEL 9 : python3.12 (RHSA-2024:10978)	Nessus	Red Hat Local Security Checks	high
212676	RHEL 8 : python3.12 (RHSA-2024:10980)	Nessus	Red Hat Local Security Checks	high
212272	Fedora 40 : python3.14 (2024-b2cebcbb49)	Nessus	Fedora Local Security Checks	high
212208	Fedora 41 : python3.12 (2024-340a4bdc5d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-12254

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high