CVE-2024-3219

The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.

• CWE-306

• https://www.openwall.com/lists/oss-security/2024/07/29/3
• https://github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20
• https://github.com/python/cpython/commit/0b65c8bf5367625673eafb92f85046a1b31259f2
• https://github.com/python/cpython/commit/220e31adeaaa8436c9ff234cba1398bc49e2bb6c
• https://github.com/python/cpython/commit/2621a8a40ba4b2c68ca564671b7daa5da80a4508
• https://github.com/python/cpython/commit/31302f5fc24eecd693f0c8aaba7c2840b09b594d
• https://github.com/python/cpython/commit/3f5d9d12c74787fbf3f5891835c85cc15526c86d
• https://github.com/python/cpython/commit/5df322e91a40909e6904bbdbc0c3a6b6a9eead39
• https://github.com/python/cpython/commit/5f90abaa786f994db3907fc31e2ee00ea2cf0929
• https://github.com/python/cpython/commit/78df1043dbdce5c989600616f9f87b4ee72944e5
• https://github.com/python/cpython/commit/b252317956b7fc035bb3774ef6a177e227f9fc54
• https://github.com/python/cpython/commit/c21a36112a0028d7ac3cf8f480e0dc88dba5922c
• https://github.com/python/cpython/commit/c5655aa6ad120d2ed7f255bebd6e8b71a9c07dde
• https://github.com/python/cpython/commit/e319f774f9e766a2b92949444a2d46081df3363a
• https://github.com/python/cpython/commit/f071f01b7b7e19d7d6b3a4b0ec62f820ecb14660
• https://github.com/python/cpython/issues/122133
• https://github.com/python/cpython/pull/122134
• https://mail.python.org/archives/list/security-announce@python.org/thread/WYKDQWIERRE2ICIYMSVRZJO33GSCWU2B/
• https://www.openwall.com/lists/oss-security/2024/07/29/3
• https://github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20
• https://github.com/python/cpython/commit/0b65c8bf5367625673eafb92f85046a1b31259f2
• https://github.com/python/cpython/commit/220e31adeaaa8436c9ff234cba1398bc49e2bb6c
• https://github.com/python/cpython/commit/5f90abaa786f994db3907fc31e2ee00ea2cf0929
• https://github.com/python/cpython/commit/b252317956b7fc035bb3774ef6a177e227f9fc54
• https://github.com/python/cpython/issues/122133
• https://github.com/python/cpython/pull/122134
• https://mail.python.org/archives/list/security-announce@python.org/thread/WYKDQWIERRE2ICIYMSVRZJO33GSCWU2B/
• https://security.netapp.com/advisory/ntap-20250502-0004/

Published

Jul 29, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32162CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.4.3
• CVE-2024-32163CMSeasy 7.7.7.9 is vulnerable to code execution.6.4
• CVE-2024-32166Webid v1.2.1 suffers from an Insecure Direct Object Referenc…8.8
• CVE-2024-32167Sourcecodester Online Medicine Ordering System 1.0 is vulner…9.1
• CVE-2024-3217The WP Directory Kit plugin for WordPress is vulnerable to S…8.8
• CVE-2024-3218A vulnerability classified as critical has been found in Shi…5.4
• CVE-2024-3220There is a defect in the CPython standard library module “mi…2.3
• CVE-2024-32205Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2024-32206A stored cross-site scripting (XSS) vulnerability in the com…4.6
• CVE-2024-3221A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2024-32210The LoMag WareHouse Management application version 1.0.20.12…5.3
• CVE-2024-32211An issue in LOGINT LoMag Inventory Management v1.0.20.120 an…5.5