Repository navigation
CVE-2023-40217: Bypass TLS handshake on closed sockets #108310
Description
Bug report
Originally reported by @aapooksman via the Python Security Response Team mailing list on 2023-08-08. Thanks for the responsible disclosure!
Checklist
- I am confident this is a bug in CPython, not a bug in a third-party project
- I have searched the CPython issue tracker,
and am confident this bug has not been reported before
CPython versions tested on:
3.8, 3.9, 3.10, 3.11, 3.12, CPython main branch
Operating systems tested on:
Linux, macOS
A clear and concise description of the bug:
Instances of ssl.SSLSocket are vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and could lead applications to treat unencrypted data received pre-TLS-handshake that is followed by an immediate connection close as if it were post-handshake TLS encrypted data.
Linked PRs
- gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108315
- [3.12] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108316
- [3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108317
- [3.10] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108318
- [3.9] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108320
- [3.8] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108321
- [3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl #110718
Activity
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
[-]Placeholder issue[/-][+]CVE-2023-40217: Bypass TLS handshake on closed sockets[/+]38 remaining items
Byefsaneahmet commentedon Sep 8, 2023
Byefsaneahmet commentedon Sep 8, 2023
hugovk commentedon Sep 8, 2023
I've reported @Byefsaneahmet to GitHub for disruption.
Update python to version 2.7.18 / rev 187 via SR 1110909
[3.9] pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl …
[3.9] pythongh-108342: Break ref cycle in SSLSocket._create() exc (py…
[3.9] pythongh-108342: Make ssl TestPreHandshakeClose more reliable (p…
pythongh-108310: Fix TestPreHandshakeClose tests in test_ssl
bastien-roucaries commentedon Nov 1, 2023
Hi I have difficulty to port this to python3.5 it fail async io test... Can I get nsome help from upstream ?
vstinner commentedon Nov 1, 2023
@mcepl: Maybe you backported this change to 3.5 for OpenSUSE?
bastien-roucaries commentedon Nov 1, 2023
@vstinner pkg badly fail https://salsa.debian.org/lts-team/packages/python3.5/-/jobs/4878473 commit his here https://salsa.debian.org/lts-team/packages/python3.5/-/commit/0aac2e98ecc60e7191a2d49ab9ae99f022f0e495
I have tried shutdown instead of close() but it core dump
mcepl commentedon Nov 1, 2023
True. I have here
CVE-2023-40217-avoid-ssl-pre-close-Python34.patch and
CVE-2023-40217-avoid-ssl-pre-close-Python36.patch.txt and
CVE-2023-40217-avoid-ssl-pre-close-Python27.patch.txt, just to be complete.
[3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl (#110718)
[CVE-2023-40217] Check for & avoid the ssl pre-close flaw
wsgi: Handle ENOTCONN (#1092)