CPython 3.9 and earlier doesnt disallow configuring an empty list ([]) for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
Name | Vendor | Start Version | End Version |
---|---|---|---|
Python3.11 | Ubuntu | mantic | * |
Python3.12 | Ubuntu | mantic | * |
Python3.8 | Ubuntu | upstream | * |