CVE-2023-40217: Race Condition
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)
Other sources
Python could allow a remote attacker to bypass security restrictions, caused by a race condition in the SSLSocket module. When the socket is closed before the TLS handshake is complete, the data is treated as if it had been encrypted by TLS. An attacker could exploit this vulnerability to bypass the TLS handshake and inject a malicious client certificate into the connection and gain access to the server’s resources without being authenticated.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F5 Traffix Systems Signaling Delivery Controllerto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u4Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u5Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/python3.12to a version that resolves this vulnerability.Fixed in 3.12.10-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u3 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.11.5 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.10.13 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.9.18 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.8.18 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u4 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.11+dfsg-2+deb12u3 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.19+dfsg-2 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u5 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.8.18 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.9.18 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.10.13 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.11.5
Event History
Frequently Asked Questions
What is CVE-2023-40217?
CVE-2023-40217 is a vulnerability discovered in Python versions before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.
Who is affected by CVE-2023-40217?
Servers (such as HTTP servers) that use TLS client authentication are primarily affected by CVE-2023-40217.
What is the severity of CVE-2023-40217?
CVE-2023-40217 has a severity level of 5.3 (medium).
How can I fix CVE-2023-40217?
To fix CVE-2023-40217, it is recommended to update Python to versions 3.8.18, 3.9.18, 3.10.13, or 3.11.5.
Where can I find more information about CVE-2023-40217?
You can find more information about CVE-2023-40217 on the following references: [Link 1](https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html), [Link 2](https://mail.python.org/archives/list/security-announce@python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/), [Link 3](https://www.python.org/dev/security/).