Skip to content
OpenAdvisories
Medium ALAS2-2025-2743 1 CVE

Moderate: python3 security update (Amazon Linux 2)

Published Jan 30, 2025 · Updated Feb 4, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-debug 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-debuginfo 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-devel 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-libs 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-test 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-tkinter 0:3.7.16-1.amzn2.0.9
Amazon Linux · 2 python3-tools 0:3.7.16-1.amzn2.0.9

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-5642

    Buffer overread when using an empty list with SSLContext.set_npn_protocols()

    CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vu…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-5642.html