From 2ac26268007f654d0942797187d51d5f80a78108 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 6 Dec 2024 14:31:31 -0600 Subject: [PATCH] Add patches for CVE-2024-12254 https://nvd.nist.gov/vuln/detail/CVE-2024-12254 --- .../3.12/gh-127655-Fix-CVE-2024-12254.patch | 24 +++++++++++++++++++ .../3.13/gh-127655-Fix-CVE-2024-12254.patch | 24 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 python/3.12/gh-127655-Fix-CVE-2024-12254.patch create mode 100644 python/3.13/gh-127655-Fix-CVE-2024-12254.patch diff --git a/python/3.12/gh-127655-Fix-CVE-2024-12254.patch b/python/3.12/gh-127655-Fix-CVE-2024-12254.patch new file mode 100644 index 0000000..cef8a07 --- /dev/null +++ b/python/3.12/gh-127655-Fix-CVE-2024-12254.patch @@ -0,0 +1,24 @@ +From 21dfa1330d26737631ac6d149c3992d38871678b Mon Sep 17 00:00:00 2001 +From: "J. Nick Koston" +Date: Thu, 5 Dec 2024 10:01:10 -0600 +Subject: [PATCH 1/2] Ensure writelines pauses the protocol if needed + +--- + Lib/asyncio/selector_events.py | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py +index f94bf10b422..f1ab9b12d69 100644 +--- a/Lib/asyncio/selector_events.py ++++ b/Lib/asyncio/selector_events.py +@@ -1175,6 +1175,7 @@ def writelines(self, list_of_data): + # If the entire buffer couldn't be written, register a write handler + if self._buffer: + self._loop._add_writer(self._sock_fd, self._write_ready) ++ self._maybe_pause_protocol() + + def can_write_eof(self): + return True +-- +2.39.3 (Apple Git-145) + diff --git a/python/3.13/gh-127655-Fix-CVE-2024-12254.patch b/python/3.13/gh-127655-Fix-CVE-2024-12254.patch new file mode 100644 index 0000000..cef8a07 --- /dev/null +++ b/python/3.13/gh-127655-Fix-CVE-2024-12254.patch @@ -0,0 +1,24 @@ +From 21dfa1330d26737631ac6d149c3992d38871678b Mon Sep 17 00:00:00 2001 +From: "J. Nick Koston" +Date: Thu, 5 Dec 2024 10:01:10 -0600 +Subject: [PATCH 1/2] Ensure writelines pauses the protocol if needed + +--- + Lib/asyncio/selector_events.py | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py +index f94bf10b422..f1ab9b12d69 100644 +--- a/Lib/asyncio/selector_events.py ++++ b/Lib/asyncio/selector_events.py +@@ -1175,6 +1175,7 @@ def writelines(self, list_of_data): + # If the entire buffer couldn't be written, register a write handler + if self._buffer: + self._loop._add_writer(self._sock_fd, self._write_ready) ++ self._maybe_pause_protocol() + + def can_write_eof(self): + return True +-- +2.39.3 (Apple Git-145) +