AIKIDO-2024-10330
gevent is vulnerable to Race Condition
25
Low Risk
This Affects:
geventTL;DR
Affected versions of the package are vulnerable to a race condition. The socket module provides a pure-Python fallback to the socket.socketpair() function for platforms that do not support AF_UNIX, such as Windows. This implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. However, the connection between the two sockets is not verified before returning them to the user, leaving the server socket vulnerable to a connection race from a malicious local peer.
Who does this affect?
You are affected if you are using a version which is within vulnerability ranges and if you are using Windows OS.
Background info
gevent is vulnerable to Race Condition in versions 1.2.0 - 24.10.0.
How to fix this
Upgrade the gevent library to the patch version.
Links
Fix Commits
github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20github.com/python/cpython/commit/0b65c8bf5367625673eafb92f85046a1b31259f2github.com/python/cpython/commit/220e31adeaaa8436c9ff234cba1398bc49e2bb6cgithub.com/python/cpython/commit/2621a8a40ba4b2c68ca564671b7daa5da80a4508github.com/python/cpython/commit/31302f5fc24eecd693f0c8aaba7c2840b09b594dgithub.com/python/cpython/commit/3f5d9d12c74787fbf3f5891835c85cc15526c86dgithub.com/python/cpython/commit/5df322e91a40909e6904bbdbc0c3a6b6a9eead39github.com/python/cpython/commit/5f90abaa786f994db3907fc31e2ee00ea2cf0929github.com/python/cpython/commit/78df1043dbdce5c989600616f9f87b4ee72944e5github.com/python/cpython/commit/b252317956b7fc035bb3774ef6a177e227f9fc54github.com/python/cpython/commit/c21a36112a0028d7ac3cf8f480e0dc88dba5922cgithub.com/python/cpython/commit/c5655aa6ad120d2ed7f255bebd6e8b71a9c07ddegithub.com/python/cpython/commit/e319f774f9e766a2b92949444a2d46081df3363agithub.com/python/cpython/commit/f071f01b7b7e19d7d6b3a4b0ec62f820ecb14660Other
github.com/gevent/gevent/blob/master/CHANGES.rst
openwall.com/lists/oss-security/2024/07/29/3mail.python.org/archives/list/security-announce@python.org/thread/WYKDQWIERRE2ICIYMSVRZJO33GSCWU2B/security.netapp.com/advisory/ntap-20250502-0004/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant