Skip to content
OpenAdvisories
Medium ALAS2-2025-2744 1 CVE

Moderate: python security update (Amazon Linux 2)

Published Jan 30, 2025 · Updated Feb 4, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 python-debug 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 python-debuginfo 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 python-devel 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 python-libs 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 python-test 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 python-tools 0:2.7.18-1.amzn2.0.10
Amazon Linux · 2 tkinter 0:2.7.18-1.amzn2.0.10

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-5642

    Buffer overread when using an empty list with SSLContext.set_npn_protocols()

    CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vu…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-5642.html