THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2024-5642 (MEDIUM 6.5) — CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low

[NVD] CVE-2024-5642 (MEDIUM 6.5) — CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low

lownvdPublished 2024-06-27

CVE-2024-5642 CVSS: 6.5 MEDIUM Published: 2024-06-27T21:15:16.070

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specif

Indicators of compromise

CVE-2024-5642cve
CVE-2024-5535cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2024-5642