This advisory covers two security vulnerabilities in python3.12 as packaged by Red Hat for Red Hat Enterprise Linux 8 and related distributions. CVE-2024-9287 concerns the lack of quoting in virtual environment activation scripts, which may lead to security issues related to path handling (CWE-428). CVE-2024-12254 involves unbounded memory buffering in the SelectorSocketTransport.writelines() function (CWE-770), potentially leading to resource exhaustion or denial of service. Red Hat has released updated python3.12 packages (version 3.12.8-1.el8_10) that address these vulnerabilities. The advisory does not provide CVSS scores but rates the impact as Important. The update is available for multiple architectures including x86_64, s390x, ppc64le, and aarch64.

The vulnerabilities could allow an attacker to exploit unquoted paths in virtual environment activation scripts, potentially leading to unintended command execution or privilege escalation. The unbounded memory buffering issue could lead to excessive memory consumption, causing denial of service or application instability. The advisory rates these issues as Important, indicating a significant security impact if left unpatched.

Red Hat has released updated python3.12 packages that fix these vulnerabilities. Users should apply the python3.12 update (version 3.12.8-1.el8_10) available through Red Hat Enterprise Linux 8 repositories. For detailed update instructions, refer to Red Hat's official article: https://access.redhat.com/articles/11258. No additional mitigations are indicated or required beyond applying the official update.