DocumentationSeverity
6.8
Medium severity
Details
- CVSS score
- 6.8
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
Impact
AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call.
Anyone who runs untrusted or faulty code that writes too much to stderr is at risk.
Patches
This vulnerability will be patched in v4.14.2.
Workarounds
Closing sys.stderr in the target function should at least prevent the deadlock.
Details
- Affected product:
- FastAPI , Starlette , airflow , anyio , apache-airflow-providers-http , cadwyn , httpcore , httpx , huggingface_hub , langchain-core , langchain-text-splitters , langgraph-checkpoint , langsmith-sdk , mlflow , pbs-installer , poetry , poetry-plugin-export , tokenizers , uvicorn , watchfiles
- Affected packages:
- anyio @ 3.7.1 (+107 more)