Repository navigation
CVE-2023-40217: Bypass TLS handshake on closed sockets #108310
Description
Activity
- added 7 commits that reference this issue
on Aug 22, 2023 - changed the title
[-]Placeholder issue[/-][+]CVE-2023-40217: Bypass TLS handshake on closed sockets[/+]on Aug 22, 2023 38 remaining items
I've reported @Byefsaneahmet to GitHub for disruption.
Reacted by Gregory P. Smith and Weiguo Kong- added a commit that references this issue
on Sep 14, 2023 - added 3 commits that reference this issue
on Oct 11, 2023 Hi I have difficulty to port this to python3.5 it fail async io test... Can I get nsome help from upstream ?
@vstinner pkg badly fail https://salsa.debian.org/lts-team/packages/python3.5/-/jobs/4878473 commit his here https://salsa.debian.org/lts-team/packages/python3.5/-/commit/0aac2e98ecc60e7191a2d49ab9ae99f022f0e495
I have tried shutdown instead of close() but it core dump
@mcepl: Maybe you backported this change to 3.5 for OpenSUSE?
True. I have here
CVE-2023-40217-avoid-ssl-pre-close-Python34.patch and
CVE-2023-40217-avoid-ssl-pre-close-Python36.patch.txt and
CVE-2023-40217-avoid-ssl-pre-close-Python27.patch.txt, just to be complete.- added a commit that references this issue
on Apr 4, 2024
Bug report
Originally reported by @aapooksman via the Python Security Response Team mailing list on 2023-08-08. Thanks for the responsible disclosure!
Checklist
and am confident this bug has not been reported before
CPython versions tested on:
3.8, 3.9, 3.10, 3.11, 3.12, CPython main branch
Operating systems tested on:
Linux, macOS
A clear and concise description of the bug:
Instances of ssl.SSLSocket are vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and could lead applications to treat unencrypted data received pre-TLS-handshake that is followed by an immediate connection close as if it were post-handshake TLS encrypted data.
Linked PRs