Red Hat Bug Fix Advisory: python3.12 bug fix and enhancement update

Fixed packages 11

Vulnerabilities 4

• High 8.7
  CVE-2024-12254

  Unbounded memory buffering in SelectorSocketTransport.writelines()

  Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not …

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 6, 2024
• High 7.5
  CVE-2024-6232 Public exploit

  Regular-expression DoS when parsing TarFile headers

  There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 3, 2024
• Medium 6.3
  CVE-2025-0938

  URL parser allowed square brackets in domain names

  The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 31, 2025
• Medium 5.3
  CVE-2024-9287

  Virtual environment (venv) activation scripts don't quote paths

  A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 22, 2024

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/index
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_6294.json
• report
  https://access.redhat.com/security/cve/CVE-2024-6232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2309426
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-6232
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-6232
• article
  https://github.com/python/cpython/issues/121285
• article
  https://github.com/python/cpython/pull/121286
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/
• report
  https://access.redhat.com/security/cve/CVE-2024-9287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2321440
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9287
• article
  https://github.com/python/cpython/issues/124651
• article
  https://github.com/python/cpython/pull/124712
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/
• report
  https://access.redhat.com/security/cve/CVE-2024-12254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2330804
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-12254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-12254
• article
  https://github.com/python/cpython/issues/127655
• article
  https://github.com/python/cpython/pull/127656
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/
• report
  https://access.redhat.com/security/cve/CVE-2025-0938
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2343237
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-0938
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-0938
• article
  https://github.com/python/cpython/issues/105704
• article
  https://github.com/python/cpython/pull/129418