CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()

2024-06-2721:05:31

PSF

github.com

buffer overread

sslcontext

set_npn_protocols

cpython 3.9

openssl

vulnerability

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

CPython 3.9 and earlier doesn’t disallow configuring an empty list (“[]”) for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

CNA Affected

[
  {
    "repo": "https://github.com/python/cpython",
    "vendor": "Python Software Foundation",
    "product": "CPython",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.10.0b1",
        "versionType": "python"
      }
    ],
    "defaultStatus": "unaffected"
  }
]