Missing Authentication for Critical Function

Summary

There is a MEDIUM severity vulnerability affecting CPython. The "socket" module provides a pure-Python fallback to the "socket.socketpair()" function for platforms that don't support "AF_UNIX", such as Windows. This pure-Python implementation uses "AF_INET or AF_INET6" to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support "AF_UNIX" such as Linux and macOS are not affected by this vulnerability. This vulnerability affects cpython package versions 3.5.0a1 through v3.8.19, v3.9.0 through v3.9.19, v3.10.0 through v3.10.14, v3.11.0 through v3.11.9, v3.12.0 through v3.12.4, v3.13.0a1 through v3.13.0b4. Versions prior to CPython 3.5.0a1 are not affected due to the vulnerable API not being included.