CVE-2024-5642
Medium
Description
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
SeverityMedium
CVSS6.5
Exploit probability—
ProductCPython
PublishedJun 27, 2024
First seenJun 27, 2024
How to fix
Update
- Python Software Foundation CPython3.9.24, 3.10.0b1 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.9.24, 3.10.0a1 ≤ v < 3.10.0b1 | 3.9.24, 3.10.0b1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.