CVE-2023-40217: Bypass TLS handshake on closed sockets #108310
Description
Bug report
Originally reported by @aapooksman via the Python Security Response Team mailing list on 2023-08-08. Thanks for the responsible disclosure!
Checklist
- I am confident this is a bug in CPython, not a bug in a third-party projectI have searched the , and am confident this bug has not been reported before
CPython versions tested on:
3.8, 3.9, 3.10, 3.11, 3.12, CPython main branch
Operating systems tested on:
Linux, macOS
A clear and concise description of the bug:
Instances of ssl.SSLSocket are vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and could lead applications to treat unencrypted data received pre-TLS-handshake that is followed by an immediate connection close as if it were post-handshake TLS encrypted data.
Linked PRs
- gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108315
- [3.12] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108316
- [3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108317
- [3.10] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108318
- [3.9] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108320
- [3.8] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108321
- [3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl #110718
Metadata
Metadata
Labels
Projects
Milestone
Relationships
Development
No branches or pull requests
Activity
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…
[-]Placeholder issue[/-][+]CVE-2023-40217: Bypass TLS handshake on closed sockets[/+]59 remaining items
Update python to version 2.7.18 / rev 187 via SR 1110909
[3.9] pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl …
[3.9] pythongh-108342: Break ref cycle in SSLSocket._create() exc (py…
[3.9] pythongh-108342: Make ssl TestPreHandshakeClose more reliable (p…
pythongh-108310: Fix TestPreHandshakeClose tests in test_ssl
bastien-roucaries commentedon Nov 1, 2023
Hi I have difficulty to port this to python3.5 it fail async io test... Can I get nsome help from upstream ?
vstinner commentedon Nov 1, 2023
@mcepl: Maybe you backported this change to 3.5 for OpenSUSE?
bastien-roucaries commentedon Nov 1, 2023
@vstinner pkg badly fail https://salsa.debian.org/lts-team/packages/python3.5/-/jobs/4878473 commit his here https://salsa.debian.org/lts-team/packages/python3.5/-/commit/0aac2e98ecc60e7191a2d49ab9ae99f022f0e495
I have tried shutdown instead of close() but it core dump
mcepl commentedon Nov 1, 2023
True. I have here
CVE-2023-40217-avoid-ssl-pre-close-Python34.patch and
CVE-2023-40217-avoid-ssl-pre-close-Python36.patch.txt and
CVE-2023-40217-avoid-ssl-pre-close-Python27.patch.txt, just to be complete.
[3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl (#110718)
[CVE-2023-40217] Check for & avoid the ssl pre-close flaw