Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.5; 3.13.0a1 to before 3.13.0rc1 | 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.5, 3.13.0rc1 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.5; 3.13.0a1 to before 3.13.0rc1 Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.5, 3.13.0rc1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.5, 3.13.0rc1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3219
- 2026-10-03 Alias added: GHSA-r8h6-cwxj-rv5j
References
Patch 15
- https://github.com/python/cpython/pull/122134
- https://github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20
- https://github.com/python/cpython/commit/0b65c8bf5367625673eafb92f85046a1b31259f2
- https://github.com/python/cpython/commit/220e31adeaaa8436c9ff234cba1398bc49e2bb6c
- https://github.com/python/cpython/commit/5f90abaa786f994db3907fc31e2ee00ea2cf0929
- https://github.com/python/cpython/commit/b252317956b7fc035bb3774ef6a177e227f9fc54
- https://github.com/python/cpython/commit/2621a8a40ba4b2c68ca564671b7daa5da80a4508
- https://github.com/python/cpython/commit/5df322e91a40909e6904bbdbc0c3a6b6a9eead39
- https://github.com/python/cpython/commit/c21a36112a0028d7ac3cf8f480e0dc88dba5922c
- https://github.com/python/cpython/commit/f071f01b7b7e19d7d6b3a4b0ec62f820ecb14660
- https://github.com/python/cpython/commit/31302f5fc24eecd693f0c8aaba7c2840b09b594d
- https://github.com/python/cpython/commit/3f5d9d12c74787fbf3f5891835c85cc15526c86d
- https://github.com/python/cpython/commit/c5655aa6ad120d2ed7f255bebd6e8b71a9c07dde
- https://github.com/python/cpython/commit/e319f774f9e766a2b92949444a2d46081df3363a
- https://github.com/python/cpython/commit/78df1043dbdce5c989600616f9f87b4ee72944e5
Advisory 1
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2024-3219 · CVE Program
- CVE-2024-3219 · NVD
- FIRST EPSS
- GHSA-r8h6-cwxj-rv5j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences