GeezerVison is showing github.com — [3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw by ambv · Pull Request #108317 · python/cpython
Conversation
ambv
commented
Aug 22, 2023
•
edited by bedevere-bot
Loading
Uh oh!
There was an error while loading. Please reload this page.
Instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data.
The vulnerability is caused when a socket is connected, data is sent by the malicious peer and stored in a buffer, and then the malicious peer closes the socket within a small timing window before the other peers’ TLS handshake can begin. After this sequence of events the closed socket will not immediately attempt a TLS handshake due to not being connected but will also allow the buffered data to be read as if a successful TLS handshake had occurred.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
gpshead reacted with thumbs up emoji
…ose flaw
Instances of `ssl.SSLSocket` were vulnerable to a bypass of the TLS handshake
and included protections (like certificate verification) and treating sent
unencrypted data as if it were post-handshake TLS encrypted data.
The vulnerability is caused when a socket is connected, data is sent by the
malicious peer and stored in a buffer, and then the malicious peer closes the
socket within a small timing window before the other peers’ TLS handshake can
begin. After this sequence of events the closed socket will not immediately
attempt a TLS handshake due to not being connected but will also allow the
buffered data to be read as if a successful TLS handshake had occurred.
Co-Authored-By: Gregory P. Smith [Google LLC] <[email protected]>
ambv
changed the title
gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw
[3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw
Aug 22, 2023
⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️
Hi! The buildbot AMD64 Windows10 3.11 has failed when building commit 75a875e.
What do you need to do:
- Don't panic.
- Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
- Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/986/builds/1085) and take a look at the build logs.
- Check if the failure is related to this commit (75a875e) or if it is a false positive.
- If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.
You can take a look at the buildbot page here:
https://buildbot.python.org/all/#builders/986/builds/1085
Summary of the results of the build (if available):
== Tests result: ENV CHANGED ==
402 tests OK.
10 slowest tests:
- test_multiprocessing_spawn: 3 min 16 sec
- test_tokenize: 2 min 59 sec
- test_asyncio: 2 min 25 sec
- test_unparse: 2 min 23 sec
- test_peg_generator: 2 min 21 sec
- test_lib2to3: 2 min 8 sec
- test_concurrent_futures: 1 min 47 sec
- test_capi: 1 min 42 sec
- test_compileall: 1 min 32 sec
- test_mmap: 1 min 29 sec
1 test altered the execution environment:
test_ssl
31 tests skipped:
test_curses test_dbm_gnu test_dbm_ndbm test_devpoll test_epoll
test_fcntl test_fork1 test_gdb test_grp test_ioctl test_kqueue
test_multiprocessing_fork test_multiprocessing_forkserver test_nis
test_openpty test_ossaudiodev test_pipes test_poll test_posix
test_pty test_pwd test_readline test_resource test_spwd
test_syslog test_threadsignals test_wait3 test_wait4
test_xxlimited test_xxtestfuzz test_zipfile64
Total duration: 17 min 33 sec
Click to see traceback logs
Traceback (most recent call last):
File "D:\buildarea\3.11.bolen-windows10\build\Lib\threading.py", line 1038, in _bootstrap_inner
self.run()
File "D:\buildarea\3.11.bolen-windows10\build\Lib\test\test_ssl.py", line 4945, in run
conn, address = self.listener.accept()
^^^^^^^^^^^^^^^^^^^^^^
File "D:\buildarea\3.11.bolen-windows10\build\Lib\socket.py", line 294, in accept
fd, addr = self._accept()
^^^^^^^^^^^^^^
TimeoutError: timed out
k
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.