feat: Updated at 20250206121645

Signed-off-by: bitnami-bot <[email protected]>
bitnami · Feb 6, 2025 · 6f3f035 · 6f3f035
1 parent d8693a4
commit 6f3f035
Show file tree

Hide file tree

Showing 2 changed files with 160 additions and 0 deletions.
diff --git a/data/python-min/BIT-python-min-2024-12254.json b/data/python-min/BIT-python-min-2024-12254.json
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.5.0",
+  "id": "BIT-python-min-2024-12254",
+  "details": "Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not \"pause\" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the \"high-water mark\". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.",
+  "aliases": [
+    "CVE-2024-12254"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "python-min",
+        "purl": "pkg:bitnami/python-min"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V3",
+          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "3.12.0"
+            },
+            {
+              "fixed": "3.12.9"
+            },
+            {
+              "introduced": "3.13.0"
+            },
+            {
+              "fixed": "3.13.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "High",
+    "cpes": [
+      "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/issues/127655"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/pull/127656"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mail.python.org/archives/list/[email protected]/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/12/06/1"
+    }
+  ],
+  "published": "2025-02-06T12:33:16.877Z",
+  "modified": "2025-02-06T12:53:47.047Z"
+}
diff --git a/data/python/BIT-python-2024-12254.json b/data/python/BIT-python-2024-12254.json
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.5.0",
+  "id": "BIT-python-2024-12254",
+  "details": "Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not \"pause\" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the \"high-water mark\". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion.This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.",
+  "aliases": [
+    "CVE-2024-12254"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "python",
+        "purl": "pkg:bitnami/python"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V3",
+          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "3.12.0"
+            },
+            {
+              "fixed": "3.12.9"
+            },
+            {
+              "introduced": "3.13.0"
+            },
+            {
+              "fixed": "3.13.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "High",
+    "cpes": [
+      "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/issues/127655"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/pull/127656"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mail.python.org/archives/list/[email protected]/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/12/06/1"
+    }
+  ],
+  "published": "2025-02-06T12:33:19.896Z",
+  "modified": "2025-02-06T12:53:47.047Z"
+}