Description

ambv

opened on Aug 22, 2023

Issue body actions

Bug report

Originally reported by @aapooksman via the Python Security Response Team mailing list on 2023-08-08. Thanks for the responsible disclosure!

Checklist

• I am confident this is a bug in CPython, not a bug in a third-party project
• I have searched the CPython issue tracker,
  and am confident this bug has not been reported before

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, CPython main branch

Operating systems tested on:

Linux, macOS

A clear and concise description of the bug:

Instances of ssl.SSLSocket are vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and could lead applications to treat unencrypted data received pre-TLS-handshake that is followed by an immediate connection close as if it were post-handshake TLS encrypted data.

Linked PRs

• gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108315
• [3.12] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108316
• [3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108317
• [3.10] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108318
• [3.9] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108320
• [3.8] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw #108321
• [3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl #110718

Reacted by Gregory P. Smith

Reacted by Gregory P. Smith, Mistress Alexis and xinsheng3

Activity

1. ambv

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   type-securityA security issueA security issue

   on Aug 22, 2023
2. ambv

   added 7 commits that reference this issue on Aug 22, 2023

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   f13927b

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   8285107

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   b4d0a16

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   a9627de

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   621a117

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   fc26281

   pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-cl…

   f0c1e55
3. ambv

   changed the title [-]Placeholder issue[/-] [+]CVE-2023-40217: Bypass TLS handshake on closed sockets[/+] on Aug 22, 2023
4. ambv

   added

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   on Aug 22, 2023
5. 38 remaining items

6. Byefsaneahmet commented on Sep 8, 2023

   

   Byefsaneahmet

   on Sep 8, 2023 · Hidden as abuse

   show commentMore actions
7. Byefsaneahmet commented on Sep 8, 2023

   

   Byefsaneahmet

   on Sep 8, 2023 · Hidden as abuse

   show commentMore actions
8. hugovk commented on Sep 8, 2023

   

   hugovk

   on Sep 8, 2023

   Member

   More actions

   I've reported @Byefsaneahmet to GitHub for disruption.

   Reacted by Gregory P. Smith and Weiguo Kong
9. bmwiedemann

   added a commit that references this issue on Sep 14, 2023

   Update python to version 2.7.18 / rev 187 via SR 1110909

   f6d6a81
10. carlosroman

    added 3 commits that reference this issue on Oct 11, 2023

    [3.9] pythongh-108310: Fix CVE-2023-40217: Check for & avoid the ssl …

    6368a8e

    [3.9] pythongh-108342: Break ref cycle in SSLSocket._create() exc (py…

    cc9c298

    [3.9] pythongh-108342: Make ssl TestPreHandshakeClose more reliable (p…

    e1380b6
11. frenzymadness

    added a commit that references this issue on Oct 11, 2023

    pythongh-108310: Fix TestPreHandshakeClose tests in test_ssl

    7fa62f5
12. bastien-roucaries commented on Nov 1, 2023

    

    bastien-roucaries

    on Nov 1, 2023

    More actions

    Hi I have difficulty to port this to python3.5 it fail async io test... Can I get nsome help from upstream ?
13. vstinner commented on Nov 1, 2023

    

    vstinner

    on Nov 1, 2023

    Member

    More actions

    @mcepl: Maybe you backported this change to 3.5 for OpenSUSE?
14. bastien-roucaries commented on Nov 1, 2023

    

    bastien-roucaries

    on Nov 1, 2023

    More actions

    @vstinner pkg badly fail https://salsa.debian.org/lts-team/packages/python3.5/-/jobs/4878473 commit his here https://salsa.debian.org/lts-team/packages/python3.5/-/commit/0aac2e98ecc60e7191a2d49ab9ae99f022f0e495

    I have tried shutdown instead of close() but it core dump
15. mcepl commented on Nov 1, 2023

    

    mcepl

    on Nov 1, 2023

    Contributor

    More actions

    @mcepl: Maybe you backported this change to 3.5 for OpenSUSE?

    True. I have here
    CVE-2023-40217-avoid-ssl-pre-close-Python34.patch and
    CVE-2023-40217-avoid-ssl-pre-close-Python36.patch.txt and
    CVE-2023-40217-avoid-ssl-pre-close-Python27.patch.txt, just to be complete.
16. ambv

    added a commit that references this issue on Jan 17, 2024

    [3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl (#110718)

    0df2eb5
17. mcepl

    added a commit that references this issue on Apr 4, 2024

    [CVE-2023-40217] Check for & avoid the ssl pre-close flaw

    de8396e
18. 4383

    added a commit that references this issue on May 26, 2026

    wsgi: Handle ENOTCONN (#1092)

    9ae53a3

Issue actions