Repository navigation
Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133
Description
Bug report
Bug description:
socket.socketpair() has a fall-back implementation on platforms that don't support socket.AF_UNIX which uses AF_INET[6] sockets bound to localhost. This connection is expected to come from the same process.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux, Windows
Linked PRs
- gh-122133: Authenticate socket connection for socket.socketpair() fallback #122134
- [3.13] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122424
- [3.12] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122425
- [3.11] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122426
- [3.10] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122427
- [3.9] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122428
- [3.8] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122429
- gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. #122493
- [3.13] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122504
- [3.12] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122505
- [3.11] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122506
- [3.10] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122507
- [3.9] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122508
- [3.8] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122509
Activity
gh-122133: Authenticate socket connection for `socket.socketpair()` f…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
[3.12] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.13] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.11] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.10] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.9] gh-122133: Authenticate socket connection for `socket.socketpai…
[3.8] gh-122133: Authenticate socket connection for `socket.socketpai…
1 remaining item
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
[3.13] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.12] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.11] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.10] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.9] gh-122133: Rework pure Python socketpair tests to avoid use of …
[3.8] gh-122133: Rework pure Python socketpair tests to avoid use of …
cfi-gb commented on Aug 12, 2024
Only for (easier) tracking purposes (because searching for this CVE doesn't yield any results in this repo), it seems CVE-2024-3219 is now linked to this issue:
pythongh-122133: Rework pure Python socketpair tests to avoid use of …