CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()
An attacker can cause a buffer over-read and potential denial of service by configuring an empty list for NPN protocols in Python's SSL module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5642?
CVE-2024-5642 is a medium-severity memory corruption vulnerability in CPython, published on 27 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
Which versions are affected by CVE-2024-5642?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.24 |
python Bitnami | All versions | 3.9.24 |
python-min Bitnami | All versions | 3.9.24 |
Linux distribution packages (7)
python3 SUSE:Linux Enterprise Micro 5.1 | All versions | 3.6.15-150000.3.158.1 |
python3-core SUSE:Linux Enterprise Micro 5.1 | All versions | 3.6.15-150000.3.158.1 |
python36 SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.15-64.1 |
python36-core SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.15-64.1 |
python36 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.15-64.1 |
python36-core SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.15-64.1 |
python36-core SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.6.15-64.1 |
How do I fix CVE-2024-5642?
Upgrade libpython to 3.9.24 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-5642 being exploited?
There is no known exploitation of CVE-2024-5642 in the wild and no public exploit code.
Sources
Also known as BIT-libpython-2024-5642, BIT-python-2024-5642, BIT-python-min-2024-5642, DEBIAN-CVE-2024-5642, ECHO-92bd-fc28-530b, GHSA-hrvr-7x5w-xpmq and 7 more.