{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-3219 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-3219 is a medium-severity vulnerability in CPython, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-3219 and fix it if it is affected.\n\nWhat it is: CVE-2024-3219 is a medium-severity vulnerability in CPython, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-3219 in the wild and no public exploit code.\n\nAffected product: CPython. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-3219/ (Markdown: https://insights.sbomify.com/CVE-2024-3219/index.md)","id":"CVE-2024-3219","markdown":"https://insights.sbomify.com/CVE-2024-3219/index.md","name":"CVE-2024-3219","record":{"aliases":["GHSA-r8h6-cwxj-rv5j","PSF-2024-7"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Python standard library","requires_auth":"none","summary":"A race condition in the pure-Python socketpair fallback allows malicious local peers to hijack connections on Windows platforms.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"PSF","cpe":[],"cvss":{"score":5.1,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"description":"The\n “socket” module provides a pure-Python fallback to the \nsocket.socketpair() function for platforms that don’t support AF_UNIX, \nsuch as Windows. This pure-Python implementation uses AF_INET or \nAF_INET6 to create a local connected pair of sockets. The connection \nbetween the two sockets was not verified before passing the two sockets \nback to the user, which leaves the server socket vulnerable to a \nconnection race from a malicious local peer.\n\nPlatforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection","id":"CVE-2024-3219","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2024"},"n_packages":0,"n_references":18,"next":{"headline":"Default mimetype known files writeable on Windows","id":"CVE-2024-3220"},"packages":[],"prev":{"headline":"Shibang Communications IP Network Intercom Broadcasting System busyscreenshotpush.php path traversal","id":"CVE-2024-3218"},"products":["CPython"],"published":"2024-07-29","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-05-02","vendors":["Python Software Foundation"]},"summary":"A race condition in the pure-Python socketpair fallback allows malicious local peers to hijack connections on Windows platforms.","url":"https://insights.sbomify.com/CVE-2024-3219/"}