CVE-2024-12254

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.

This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
• python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
• python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.

This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.

This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.

This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.

This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

These are all security issues fixed in the python312-3.12.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-aiohttp-3.11.16-1.1 package on the GA media of openSUSE Tumbleweed.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.

This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

• python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python312 fixes the following issues:

• CVE-2024-12254: Fixed unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290)

Other fixes:

• Updated to version 3.12.8
• Remove -IVendor/ from python-config (bsc#1231795)

This update for python313 fixes the following issues:

Update to version 3.13.5.

Security issues fixed:

• CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
• CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
• CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
• CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the modification of some file metadata. (bsc#1244059)
• CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse (bsc#1236705).
• CVE-2024-12718: bypass extraction filter to modify file metadata outside extraction directory (bsc#1244056)
• CVE-2024-12254: memory exhaustion due to unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290).

Other changes and issues fixed:

Changes from 3.13.5:

• Tests

  • gh-135120: Add test.support.subTests().

• Library

  • gh-133967: Do not normalize locale name ‘C.UTF-8’ to ‘en_US.UTF-8’.
  • gh-135326: Restore support of integer-like objects with index() in random.getrandbits().
  • gh-135321: Raise a correct exception for values greater than 0x7fffffff for the BINSTRING opcode in the C implementation of pickle.
  • gh-135276: Backported bugfixes in zipfile.Path from zipp 3.23. Fixed .name, .stem and other basename-based properties on Windows when working with a zipfile on disk.
  • gh-134151: email: Fix TypeError in email.utils.decode_params() when sorting RFC 2231 continuations that contain an unnumbered section.
  • gh-134152: email: Fix parsing of email message ID with invalid domain.
  • gh-127081: Fix libc thread safety issues with os by replacing getlogin with getlogin_r re-entrant version.
  • gh-131884: Fix formatting issues in json.dump() when both indent and skipkeys are used.

• Core and Builtins

  • gh-135171: Roll back changes to generator and list comprehensions that went into 3.13.4 to fix gh-127682, but which involved semantic and bytecode changes not appropriate for a bugfix release.

• C API

  • gh-134989: Fix Py_RETURN_NONE, Py_RETURN_TRUE and Py_RETURN_FALSE macros in the limited C API 3.11 and older: don’t treat Py_None, Py_True and Py_False as immortal. Patch by Victor Stinner.
  • gh-134989: Implement PyObject_DelAttr() and PyObject_DelAttrString() as macros in the limited C API 3.12 and older. Patch by Victor Stinner.

Changes from 3.13.4:

• Security

  • gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter='data' and filter='tar') to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032).
  • gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273).
  • gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

• Library

  • gh-134718: ast.dump() now only omits None and [] values if they are default values.
  • gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
  • gh-134696: Built-in HACL* and OpenSSL implementations of hash function constructors now correctly accept the same documented named arguments. For instance, md5() could be previously invoked as md5(data=data) or md5(string=string) depending on the underlying implementation but these calls were not compatible. Patch by Bénédikt Tran.
  • gh-134210: curses.window.getch() now correctly handles …

This update for python312 fixes the following issues:

• CVE-2025-0938: Functions urllib.parse.urlsplit and urlparse accept domain names including square brackets (bsc#1236705).
• CVE-2024-12254: Unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290).

Other bugfixes:

• Position of SUSE Python interpreters on Externally managed environments (bsc#1228165).

It was discovered that Python incorrectly handled asyncio write buffers. A remote attacker could possibly use this issue to cause Python to consume memory, leading to a denial of service.