Vulnerability · Published Jun 27, 2024 · Assigned by PSF
CVE-2024-5642Buffer overread when using an empty list with SSLContext.set_npn_protocols()
Medium 6.5
In plain English
A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | python-unversioned-command | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3 | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3-debug | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3-devel | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3-idle | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3-libs | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3-test | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-2.el9_7 | ALSA-2025:23342 |
| AlmaLinux:8 | python39 | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-Cython | 0.29.21-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-Cython | 0.29.21-5.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-PyMySQL | 0.10.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-attrs | 20.3.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-cffi | 1.14.3-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-cffi | 1.14.3-2.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-chardet | 3.0.4-19.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-cryptography | 3.3.1-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-debug | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-devel | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-idle | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-idna | 2.10-4.module_el8.10.0+3849+a48d89aa | ALSA-2025:23530 |
| AlmaLinux:8 | python39-iniconfig | 1.1.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-libs | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-lxml | 4.6.5-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-lxml | 4.6.5-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-mod_wsgi | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-more-itertools | 8.5.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy | 1.19.4-3.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy-doc | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy-f2py | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-numpy-f2py | 1.19.4-3.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-packaging | 20.4-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pip | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pip-wheel | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pluggy | 0.13.1-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-ply | 3.11-10.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psutil | 5.8.0-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psutil | 5.8.0-4.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psycopg2 | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psycopg2-doc | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-psycopg2-tests | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-py | 1.10.0-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11 | 2.7.1-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11-devel | 2.7.1-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pybind11-devel | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pycparser | 2.20-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pyparsing | 2.4.7-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pysocks | 1.7.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pytest | 6.0.2-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+3248+c431e88c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-requests | 2.25.0-3.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-rpm-macros | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-scipy | 1.5.4-5.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux:8 | python39-setuptools | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-setuptools-wheel | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-six | 1.15.0-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-test | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-tkinter | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux:8 | python39-toml | 0.10.1-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-urllib3 | 1.25.10-5.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux:8 | python39-wcwidth | 0.2.5-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-wheel | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux:8 | python39-wheel-wheel | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| Debian:12 | pypy3 | 7.3.10+dfsg-1 | DEBIAN-CVE-2024-5642 |
| Debian:13 | pypy3 | 7.3.10+dfsg-1 | DEBIAN-CVE-2024-5642 |
| Debian:14 | pypy3 | 7.3.10+dfsg-1 | DEBIAN-CVE-2024-5642 |
| Rocky Linux:8 | Cython | 0:0.29.21-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | Cython | 0:0.29.21-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | PyYAML | 0:5.4.1-1.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | PyYAML | 0:5.4.1-1.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | PyYAML | 0:5.4.1-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1978+d4f111ba.1 | RLSA-2025:23530 |
| Rocky Linux:8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | numpy | 0:1.19.4-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | numpy | 0:1.19.4-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | pybind11 | 0:2.7.1-1.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux:8 | pytest | 0:6.0.2-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | pytest | 0:6.0.2-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1592+61442852 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1910+234ad790 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-attrs | 0:20.3.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-attrs | 0:20.3.0-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cffi | 0:1.14.3-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cffi | 0:1.14.3-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-chardet | 0:3.0.4-19.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-chardet | 0:3.0.4-19.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-chardet | 0:3.0.4-19.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cryptography | 0:3.3.1-3.module+el8.10.0+1697+7e517775 | RLSA-2025:23530 |
| Rocky Linux:8 | python-cryptography | 0:3.3.1-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-idna | 0:2.10-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-idna | 0:2.10-4.module+el8.10.0+1809+41195054 | RLSA-2025:23530 |
| Rocky Linux:8 | python-iniconfig | 0:1.1.1-2.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux:8 | python-lxml | 0:4.6.5-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-more-itertools | 0:8.5.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-more-itertools | 0:8.5.0-2.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-packaging | 0:20.4-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-packaging | 0:20.4-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pluggy | 0:0.13.1-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pluggy | 0:0.13.1-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-ply | 0:3.11-10.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | python-ply | 0:3.11-10.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-ply | 0:3.11-10.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-psutil | 0:5.8.0-4.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux:8 | python-psycopg2 | 0:2.8.6-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-psycopg2 | 0:2.8.6-3.module+el8.10.0+1660+b5b6f004 | RLSA-2025:23530 |
| Rocky Linux:8 | python-py | 0:1.10.0-1.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-py | 0:1.10.0-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pycparser | 0:2.20-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pycparser | 0:2.20-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pysocks | 0:1.7.1-4.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pysocks | 0:1.7.1-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-pysocks | 0:1.7.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-requests | 0:2.25.0-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-requests | 0:2.25.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-toml | 0:0.10.1-5.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux:8 | python-urllib3 | 0:1.25.10-5.module+el8.10.0+1545+03246da9 | RLSA-2025:23530 |
| Rocky Linux:8 | python-urllib3 | 0:1.25.10-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wcwidth | 0:0.2.5-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wcwidth | 0:0.2.5-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-2.el9_7 | RLSA-2025:23342 |
| Rocky Linux:8 | python3x-pip | 0:20.2.4-9.module+el8.10.0+1721+e52d6351 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-pip | 0:20.2.4-9.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-pyparsing | 0:2.4.7-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-pyparsing | 0:2.4.7-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-setuptools | 0:50.3.2-7.module+el8.10.0+2057+30213a2b | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-six | 0:1.15.0-3.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
| Rocky Linux:8 | python3x-six | 0:1.15.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | scipy | 0:1.5.4-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux:8 | scipy | 0:1.5.4-5.module+el8.10.0+1860+afcc1c71 | RLSA-2025:23530 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.9.243.10.0a1 – before 3.10.0b1 |
References
- https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html third-party-advisory
- https://github.com/python/cpython/pull/23014 mitigation
- https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/ vendor-advisory
- https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e patch
- http://www.openwall.com/lists/oss-security/2024/06/28/4
- https://github.com/python/cpython/issues/121227 issue-tracking
- https://security.netapp.com/advisory/ntap-20240726-0005/
- https://github.com/python/cpython/commit/a2cdbb6e8188ba9ba8b356b28d91bff60e86fe31 patch