CVE-2024-5642

2024-06-2805:08:41

redhat.com

access.redhat.com

cve-2024-5642

cpython 3.9

sslcontext

buffer over-read vulnerability

openssl

npn

low severity

protocol name

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

A vulnerability was found in Python/CPython that does not disallow configuring an empty list (“[]”) for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This issue results in a buffer over-read when NPN is used. See CVE -2024-5535 for OpenSSL for more information.