CVE-2010-3493 Race condition in n/a

Medium 4.3 Published 19 Oct 2010 Updated 7 Aug 2024

Remote attackers can cause a denial of service in the Python smtpd module by exploiting race conditions during TCP connection handling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2010-3493?

CVE-2010-3493 is a medium-severity vulnerability in Python Python, published on 19 Oct 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.

Weakness: CWE-362

Which versions are affected by CVE-2010-3493?

It affects 1 product.

Products include Python Python.

How do I fix CVE-2010-3493?

Upgrade to a fixed version.

Is CVE-2010-3493 being exploited?

There is no known exploitation of CVE-2010-3493 in the wild and no public exploit code.

All Python Python vulnerabilities

Sources

Also known as GHSA-5rjw-m4xp-g2m7, PSF-2010-7.