Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection

published 2024-07-29 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-31811

cvss: 5.1; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer.

Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.

Patch / fix

fixed in 1 links 10

Python Software Foundation CPython 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.5, 3.13.0rc1

github.com/python/cpython@06fa244 commit
github.com/python/cpython@0b65c8b commit
github.com/python/cpython@220e31a commit
github.com/python/cpython@5f90aba commit
github.com/python/cpython@b252317 commit
github.com/python/cpython@2621a8a commit
github.com/python/cpython@5df322e commit
github.com/python/cpython@c21a361 commit
github.com/python/cpython@f071f01 commit
github.com/python/cpython@31302f5 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-07-31)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.1	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.1	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Python Software Foundation CPython

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

Sources

CVE List CVE-2024-3219
NVD CVE-2024-3219

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary