CVE-2024-5642

Published: 27 June 2024

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Notes

Author	Note
	Priority reason: Requires unlikely API usage to be vulnerable.

Priority

Status

Package	Release	Status
python2.7 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	mantic	Does not exist
	noble	Does not exist
	trusty	Needs triage
	upstream	Needs triage
	xenial	Needs triage
python3.10 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Not vulnerable (3.10.4-3)
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	Patches: upstream: https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e
python3.11 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Not vulnerable (3.11.0~rc1-1~22.04)
	mantic	Ignored (end of life, was needs-triage)
	noble	Does not exist
	upstream	Needs triage
python3.12 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Ignored (end of life, was needs-triage)
	noble	Not vulnerable (3.12.3-1)
	upstream	Needs triage
python3.4 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Needs triage
	upstream	Needs triage
python3.5 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Needs triage
	upstream	Needs triage
	xenial	Needs triage
python3.6 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
python3.7 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	Patches: upstream: https://github.com/python/cpython/commit/961774184eb950e2547ab0d42653439adc735924
python3.8 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (3.8.0-3ubuntu1~18.04.2)
	focal	Not vulnerable (3.8.2-1ubuntu1)
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Released (3.8.0)
	Patches: upstream: https://github.com/python/cpython/commit/29eab55309b9f78b79074d26db16a44e7841c639
python3.9 Launchpad, Ubuntu, Debian	focal	Needs triage
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›