Intel

AIKIDO-2024-10057

peewee is vulnerable to Race Condition

Race Condition Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Apr 26, 2024

55

Medium Risk

This Affects:

pythonpeewee
2.2.2 - 3.17.0
Fixed in 3.17.1
Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to a race condition due to unsafe locking mechanisms around pool connection management. This could result in resource exhaustion.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

peewee is vulnerable to Race Condition in versions 2.2.2 - 3.17.0.

How to fix this

Upgrade the peewee library to the patch version.