Critical TLS Client Authentication Vulnerability in Python Packages
Summary
UBUNTU-CVE-2023-40217: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm18. Fixed in 2.7.6-8ubuntu0.6+esm18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its simplicity and versatility. It supports various programming paradigms and is extensively used in web development, data analysis, artificial intelligence, and more. The affected packages include multiple versions of Python (2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, and 3.11) that are vulnerable to a specific issue related to TLS client authentication, which can lead to unauthorized data access.
Vulnerability Detail
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as 'not connected' and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, leading to potential data leakage.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm18
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using TLS client authentication until the package is updated. This can be done by configuring your server to disable client certificate verification.
Conclusion
The vulnerability in various Python packages related to TLS client authentication poses a significant risk of data leakage. It is crucial to update to the patched versions of the affected packages to ensure the security of your applications. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python2.7 →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
The affected versions include Python 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, and 3.11.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive data due to improper handling of TLS client authentication, which may result in data leakage.
Yes, you can temporarily disable TLS client authentication to mitigate the risk until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
