BIT-python-min-2024-5642: Buffer overread when using an empty list with SSLContext.set_npn_protocols()

Q: Which deployments are realistically exposed?

Deployments using CPython 3.9 or earlier are exposed only if they use NPN and configure SSLContext.set_npn_protocols() with an empty list. The issue is considered low severity in practice because NPN is not widely used and an empty protocol list is uncommon.

Q: What must an attacker do to trigger the issue?

The available information identifies the triggering condition as an application configuring SSLContext.set_npn_protocols([]) and then using NPN. It does not describe any additional attacker prerequisites or interaction.

Q: How can I determine whether my application is affected?

Check whether the application runs CPython 3.9 or earlier, uses NPN, and has code or configuration that calls SSLContext.set_npn_protocols() with []. A non-empty list of protocol names does not match the described trigger condition.

Q: What can be done if updating is not immediately possible?

Avoid configuring an empty list for SSLContext.set_npn_protocols(). If NPN is not needed, avoid using it; otherwise configure a non-empty list of protocol names.

Published Jun 27, 2024

Updated

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.setnpnprotocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Affected Software

1 affected component

Python Software Foundation CPython<=3.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Do not configure SSLContext.set_npn_protocols() with an empty list ([]); specify a protocol name instead.
CPython SSLContext set_npn_protocols() = non-empty protocol list

Event History

Jun 27, 2024

CVE Published

via OSV·09:05 PM

Data Sourced

via OSV·09:05 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are realistically exposed?

Deployments using CPython 3.9 or earlier are exposed only if they use NPN and configure SSLContext.set_npn_protocols() with an empty list. The issue is considered low severity in practice because NPN is not widely used and an empty protocol list is uncommon.

What must an attacker do to trigger the issue?

The available information identifies the triggering condition as an application configuring SSLContext.set_npn_protocols([]) and then using NPN. It does not describe any additional attacker prerequisites or interaction.

How can I determine whether my application is affected?

Check whether the application runs CPython 3.9 or earlier, uses NPN, and has code or configuration that calls SSLContext.set_npn_protocols() with []. A non-empty list of protocol names does not match the described trigger condition.

What can be done if updating is not immediately possible?

Avoid configuring an empty list for SSLContext.set_npn_protocols(). If NPN is not needed, avoid using it; otherwise configure a non-empty list of protocol names.

BIT-python-min-2024-5642: Buffer overread when using an empty list with SSLContext.set_npn_protocols()

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What must an attacker do to trigger the issue?

How can I determine whether my application is affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What must an attacker do to trigger the issue?

How can I determine whether my application is affected?

What can be done if updating is not immediately possible?