REDHAT-BUG-2458239: Medium severity Python Software Foundation Python vulnerability
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2458239?
The severity of REDHAT-BUG-2458239 is classified as medium (4).
How do I fix REDHAT-BUG-2458239?
To fix REDHAT-BUG-2458239, upgrade to the patched version of Python that addresses the vulnerability.
What impact does REDHAT-BUG-2458239 have on my system?
REDHAT-BUG-2458239 could allow a malicious Python process to read and write memory addresses in a privileged process.
Which Python versions are affected by REDHAT-BUG-2458239?
REDHAT-BUG-2458239 affects Python versions 3.14 and higher, specifically versions that include the 'profiling.sampling' module and asyncio introspection features.
How is REDHAT-BUG-2458239 exploited?
REDHAT-BUG-2458239 can be exploited if a privileged process connects to a malicious or infected Python process.