Description
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Python Software Foundation CPython
Default version status: unaffected
0 to < 3.9.24affected3.10.0a1 to < 3.10.0b1affected
References
- https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html ↗
- https://github.com/python/cpython/pull/23014 ↗
- https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/ ↗
- https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e ↗
- http://www.openwall.com/lists/oss-security/2024/06/28/4 ↗
- https://github.com/python/cpython/issues/121227 ↗
- https://security.netapp.com/advisory/ntap-20240726-0005/ ↗
- https://github.com/python/cpython/commit/a2cdbb6e8188ba9ba8b356b28d91bff60e86fe31 ↗