CVE-2024-5642

Katalog CVE

CVSS 6.5 · Medium EPSS 0,74%

Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Rincian

Terbit di NVD

27 Juni 2024

Terakhir diubah

31 Juli 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2024/06/28/4
• https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e
• https://github.com/python/cpython/commit/a2cdbb6e8188ba9ba8b356b28d91bff60e86fe31
• https://github.com/python/cpython/issues/121227
• https://github.com/python/cpython/pull/23014
• https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html
• https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/
• https://security.netapp.com/advisory/ntap-20240726-0005/