PT-2010-4860 · Python · Python

Steven M. Christey · Published 2010-10-19 · Updated 2019-10-29 · CVE-2010-3492

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Python versions prior to 3.2

Description The issue concerns the asyncore module in Python, which does not properly handle unsuccessful calls to the accept function. This lack of proper handling, combined with the absence of documentation on how daemon applications should manage such unsuccessful calls, facilitates denial of service attacks. These attacks can terminate daemon applications via network connections.

Recommendations For versions prior to 3.2, consider updating to a version that properly handles unsuccessful calls to the accept function to prevent denial of service attacks.

Fix

Related Identifiers

CVE-2010-3492

PSF-2010-6

Affected Products

Python

References · 15

• https://security-tracker.debian.org/tracker/CVE-2010-3492 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3492 · Security Note
• https://osv.dev/vulnerability/PSF-2010-6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3492 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:216 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3492 · Vendor Advisory
• http://bugs.python.org/issue6706 · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/09/22/3 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12111 · Note
• https://bugs.python.org/issue6706 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3492 · Note
• http://openwall.com/lists/oss-security/2010/09/09/6 · Note
• http://openwall.com/lists/oss-security/2010/09/24/3 · Note
• http://openwall.com/lists/oss-security/2010/09/11/2 · Note