Python up to 3.8.17/3.9.17/3.10.12/3.11.4 TLS Client Authentication initialization

Summaryinfo

A vulnerability classified as problematic was found in Python up to 3.8.17/3.9.17/3.10.12/3.11.4. This affects an unknown function of the component TLS Client Authentication Handler. Executing a manipulation can lead to initialization. This vulnerability is handled as CVE-2023-40217. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Python up to 3.8.17/3.9.17/3.10.12/3.11.4 (Programming Language Software). This vulnerability affects an unknown function of the component TLS Client Authentication Handler. The manipulation with an unknown input leads to a initialization vulnerability. The CWE definition for the vulnerability is CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. As an impact it is known to affect confidentiality. CVE summarizes:

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

The weakness was released 08/25/2023. The advisory is shared for download at mail.python.org. This vulnerability was named CVE-2023-40217 since 08/10/2023. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 210518 (Debian dla-3948 : pypy3 - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.8.18, 3.9.18, 3.10.13 or 3.11.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (210518) and EUVD (EUVD-2023-44814). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• Python

Version

• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6
• 3.8.7
• 3.8.8
• 3.8.9
• 3.8.10
• 3.8.11
• 3.8.12
• 3.8.13
• 3.8.14
• 3.8.15
• 3.8.16
• 3.8.17
• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.9.7
• 3.9.8
• 3.9.9
• 3.9.10
• 3.9.11
• 3.9.12
• 3.9.13
• 3.9.14
• 3.9.15
• 3.9.16
• 3.9.17
• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.10.4
• 3.10.5
• 3.10.6
• 3.10.7
• 3.10.8
• 3.10.9
• 3.10.10
• 3.10.11
• 3.10.12
• 3.11.0
• 3.11.1
• 3.11.2
• 3.11.3
• 3.11.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion