This advisory covers two security fixes in python3.12 on Red Hat Enterprise Linux 9.4 EUS and related builds. CVE-2024-9287 addresses a vulnerability where virtual environment (venv) activation scripts fail to quote paths properly, potentially leading to security issues related to path handling (CWE-428). CVE-2024-12254 fixes an unbounded memory buffering issue in SelectorSocketTransport.writelines(), which could cause resource exhaustion or denial of service (CWE-770). Red Hat has released updated python3.12 packages to resolve these vulnerabilities.

The vulnerabilities could allow attackers to exploit improper path quoting in venv activation scripts or cause unbounded memory buffering, potentially leading to denial of service or other impacts related to resource exhaustion. The advisory rates the security impact as important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated python3.12 packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants that fix these vulnerabilities. Users should apply these official updates as soon as possible. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.