CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.setnpnprotocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "3.8.2-1ubuntu1", "binary_name": "idle-python3.8" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "libpython3.8" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "libpython3.8-dbg" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "libpython3.8-dev" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "libpython3.8-minimal" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "libpython3.8-stdlib" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "libpython3.8-testsuite" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8-dbg" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8-dev" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8-doc" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8-examples" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8-minimal" }, { "binary_version": "3.8.2-1ubuntu1", "binary_name": "python3.8-venv" } ], "priority_reason": "Requires unlikely API usage to be vulnerable." }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "3.10.4-3", "binary_name": "idle-python3.10" }, { "binary_version": "3.10.4-3", "binary_name": "libpython3.10" }, { "binary_version": "3.10.4-3", "binary_name": "libpython3.10-dbg" }, { "binary_version": "3.10.4-3", "binary_name": "libpython3.10-dev" }, { "binary_version": "3.10.4-3", "binary_name": "libpython3.10-minimal" }, { "binary_version": "3.10.4-3", "binary_name": "libpython3.10-stdlib" }, { "binary_version": "3.10.4-3", "binary_name": "libpython3.10-testsuite" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-dbg" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-dev" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-doc" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-examples" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-full" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-minimal" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-nopie" }, { "binary_version": "3.10.4-3", "binary_name": "python3.10-venv" } ], "priority_reason": "Requires unlikely API usage to be vulnerable." }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "idle-python3.11" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "libpython3.11" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "libpython3.11-dbg" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "libpython3.11-dev" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "libpython3.11-minimal" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "libpython3.11-stdlib" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "libpython3.11-testsuite" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-dbg" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-dev" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-doc" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-examples" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-full" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-minimal" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-nopie" }, { "binary_version": "3.11.0~rc1-1~22.04", "binary_name": "python3.11-venv" } ], "priority_reason": "Requires unlikely API usage to be vulnerable." }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "3.12.4-1ubuntu1", "binary_name": "idle-python3.12" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "libpython3.12-dev" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "libpython3.12-minimal" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "libpython3.12-stdlib" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "libpython3.12-testsuite" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "libpython3.12t64" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "libpython3.12t64-dbg" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-dbg" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-dev" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-doc" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-examples" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-full" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-minimal" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-nopie" }, { "binary_version": "3.12.4-1ubuntu1", "binary_name": "python3.12-venv" } ], "priority_reason": "Requires unlikely API usage to be vulnerable." }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "3.12.3-1", "binary_name": "idle-python3.12" }, { "binary_version": "3.12.3-1", "binary_name": "libpython3.12-dev" }, { "binary_version": "3.12.3-1", "binary_name": "libpython3.12-minimal" }, { "binary_version": "3.12.3-1", "binary_name": "libpython3.12-stdlib" }, { "binary_version": "3.12.3-1", "binary_name": "libpython3.12-testsuite" }, { "binary_version": "3.12.3-1", "binary_name": "libpython3.12t64" }, { "binary_version": "3.12.3-1", "binary_name": "libpython3.12t64-dbg" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-dbg" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-dev" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-doc" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-examples" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-full" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-minimal" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-nopie" }, { "binary_version": "3.12.3-1", "binary_name": "python3.12-venv" } ], "priority_reason": "Requires unlikely API usage to be vulnerable." }