Repository navigation
Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133
Description
Bug report
Bug description:
socket.socketpair() has a fall-back implementation on platforms that don't support socket.AF_UNIX which uses AF_INET[6] sockets bound to localhost. This connection is expected to come from the same process.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux, Windows
Linked PRs
- gh-122133: Authenticate socket connection for
socket.socketpair()fallback #122134 - [3.13] gh-122133: Authenticate socket connection for
socket.socketpair()fallback (GH-122134) #122424 - [3.12] gh-122133: Authenticate socket connection for
socket.socketpair()fallback (GH-122134) #122425 - [3.11] gh-122133: Authenticate socket connection for
socket.socketpair()fallback (GH-122134) #122426 - [3.10] gh-122133: Authenticate socket connection for
socket.socketpair()fallback (GH-122134) #122427 - [3.9] gh-122133: Authenticate socket connection for
socket.socketpair()fallback (GH-122134) #122428 - [3.8] gh-122133: Authenticate socket connection for
socket.socketpair()fallback (GH-122134) #122429 - gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. #122493
- [3.13] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122504
- [3.12] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122505
- [3.11] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122506
- [3.10] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122507
- [3.9] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122508
- [3.8] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122509
Activity
gh-122133: Authenticate socket connection for `socket.socketpair()` f…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
pythongh-122133: Authenticate socket connection for `socket.socketpai…
[3.12] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.13] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.11] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.10] gh-122133: Authenticate socket connection for `socket.socketpa…
[3.9] gh-122133: Authenticate socket connection for `socket.socketpai…
[3.8] gh-122133: Authenticate socket connection for `socket.socketpai…
1 remaining item
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
pythongh-122133: Rework pure Python socketpair tests to avoid use of …
[3.13] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.12] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.11] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.10] gh-122133: Rework pure Python socketpair tests to avoid use of…
[3.9] gh-122133: Rework pure Python socketpair tests to avoid use of …
[3.8] gh-122133: Rework pure Python socketpair tests to avoid use of …
cfi-gb commentedon Aug 12, 2024
Only for (easier) tracking purposes (because searching for this CVE doesn't yield any results in this repo), it seems CVE-2024-3219 is now linked to this issue:
pythongh-122133: Rework pure Python socketpair tests to avoid use of …