Description

chgnrdv

opened on Jun 21, 2022

Issue body actions

Example:

>>> import ssl
>>> s = ssl.SSLSession()
>>> s.id
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff73b8949 in SSL_SESSION_get_id () from /usr/lib/libssl.so.1.1

Environment:
CPython version tested on: 3.10.3, 3.12.0a0.
SSL version: 1.1.1n.
Linux, 5.16.9-arch1-1, x86_64.

The possible fix is to disallow instantiation for SSLSession type. Access to session property of SSLSocket objects works through PySSL_get_session (which does all necessary checks) and attributes of SSLSession objects are read-only so I think it shouldn't break anything.

Activity

1. chgnrdv

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Jun 21, 2022
2. miss-islington

   closed this as completedin #94102on Jun 22, 2022
3. miss-islington

   added 5 commits that reference this issue on Jun 22, 2022

   gh-94101 Disallow instantiation of SSLSession objects (GH-94102)

   dc8e1d0

   pythongh-94101 Disallow instantiation of SSLSession objects (pythonGH…

   836aaad

   pythongh-94101 Disallow instantiation of SSLSession objects (pythonGH…

   333d91b

   gh-94101 Disallow instantiation of SSLSession objects (GH-94102)

   2e8eac1

   gh-94101 Disallow instantiation of SSLSession objects (GH-94102)

   58d6a86
4. serhiy-storchaka

   added a commit that references this issue on Jun 26, 2022

   Revert 30935 defer bpo45162 to 312 (#94285)

   1ffde3e

Issue actions