PT-2024-36813 · Python+10 · Cpython+10
Seth Larson
·
Published
2024-06-27
·
Updated
2026-04-06
·
CVE-2024-5642
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
CPython versions 3.9 and earlier
Description
The issue arises from configuring an empty list for SSLContext.set npn protocols(), which is an invalid value for the underlying OpenSSL API, resulting in a buffer over-read when NPN is used. This is considered a low-severity issue due to the limited use of NPN and the uncommon practice of specifying an empty list.
Recommendations
For CPython versions 3.9 and earlier, as a temporary workaround, consider avoiding the use of an empty list for SSLContext.set npn protocols() until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Cpython
Centos
Debian
Ibm Aix
Openssl
Red Hat
Red Os
Rocky Linux
Suse