medium 6.5

CVE-2024-5642 json

Buffer overread when using an empty list with SSLContext.set_npn_protocols()

published 2024-06-27 2 y ago modified 2026-07-31 3 mo ago also BIT-libpython-2024-5642 , BIT-python-2024-5642 , BIT-python-min-2024-5642 , EUVD-2024-46822

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits: 0; none known

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Patch / fix

fixed in 4 distros 6 links 3

bitnami libpython 3.9.24
bitnami python 3.9.24
bitnami python-min 3.9.24
Python Software Foundation CPython 3.9.24, 3.10.0b1

debian red hat suse opensuse almalinux rocky linux

pypy3 Debian 14, Debian 13, Debian 12 7.3.10+dfsg-1

debian advisories DEBIAN-CVE-2024-5642

python3.9 RHEL 9 3.9.25-2.el9_7
python3 RHEL 9 3.9.25-2.el9_7
python3-idle RHEL 9 3.9.25-2.el9_7
python3-libs RHEL 9 3.9.25-2.el9_7
python3-test RHEL 9 3.9.25-2.el9_7
python3-tkinter RHEL 9 3.9.25-2.el9_7
python-unversioned-command RHEL 9 3.9.25-2.el9_7
numpy RHEL 8 1.19.4-3.module+el8.9.0+19644+d68f775d

red hat advisories RHSA-2025:23342 RHSA-2025:23530

python3 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +16 more 3.6.15-150300.10.72.1
python3-core SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +18 more 3.6.15-150300.10.72.1
python3-documentation openSUSE Leap 15.6, openSUSE Leap 15.5 3.6.15-150300.10.72.1
python36 SLES for SAP 12 SP5, SLES 12 SP5 3.6.15-64.1
python36-core SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 3.6.15-64.1
python3 SLE Micro 5.1 3.6.15-150000.3.158.1
python3-core SLE Micro 5.1 3.6.15-150000.3.158.1
python39 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Legacy 15 SP5 +4 more 3.9.19-150300.4.49.1

suse advisories SUSE-SU-2024:3470-1 SUSE-SU-2024:3353-1 SUSE-SU-2024:3351-1 SUSE-SU-2024:3076-1

python38 openSUSE Tumbleweed 3.8.19-7.1
python39 openSUSE Tumbleweed 3.9.19-6.1

opensuse advisories openSUSE-SU-2024:14256-1 openSUSE-SU-2024:14253-1

python39 AlmaLinux 8 3.9.25-2.module_el8.10.0+4083+53cad1fb
python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
python39-idle AlmaLinux 8 3.9.25-2.module_el8.10.0+4083+53cad1fb

almalinux advisories ALSA-2025:23530 ALSA-2025:23342

python3.9 Rocky Linux 9 3.9.25-2.el9_7
numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1860+afcc1c71
scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1860+afcc1c71
scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1860+afcc1c71
pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1860+afcc1c71

rocky linux advisories RLSA-2025:23342 RLSA-2025:23530

github.com/python/cpython@39258d3 commit
github.com/python/cpython@a2cdbb6 commit
github.com/python/cpython#23014 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-5642 updated 2026-11-07 cvss 2.7

python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used

Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 python2, python2-libs, python2-test, python2-tools, python2-tkinter
affected: no fix available “Fix deferred”
Red Hat Ceph Storage 8 rhceph 1769512383
fixed: vendor fix RHSA-2026:1652
Red Hat Discovery 2 discovery 1767888970, discovery 1767904573
fixed: vendor fix RHSA-2026:0414
Red Hat Enterprise Linux AppStream (v. 8) scipy 1.5.4-5.module+el8.9.0+19644+d68f775d, numpy 1.19.4-3.module+el8.9.0+19644+d68f775d, PyYAML 5.4.1-1.module+el8.9.0+19644+d68f775d, python-ply 3.11-10.module+el8.9.0+19644+d68f775d, python39 3.9.25-2.module+el8.10.0+23718+1842ae33, mod_wsgi 4.7.1-7.module+el8.10.0+23075+0aa18782.1, +49 more
fixed: vendor fix RHSA-2025:23530
Red Hat Enterprise Linux AppStream (v. 9) python3-tkinter 3.9.25-2.el9_7, python-unversioned-command 3.9.25-2.el9_7 Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.25-2.el9_7, python3.9 3.9.25-2.el9_7, python3-libs 3.9.25-2.el9_7 Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3 3.9.25-2.el9_7, python3-idle 3.9.25-2.el9_7, python3-test 3.9.25-2.el9_7, python3-tkinter 3.9.25-2.el9_7
fixed: vendor fix RHSA-2025:23342
Red Hat Enterprise Linux CRB (v. 8) pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python-attrs 20.3.0-2.module+el8.9.0+19644+d68f775d, +16 more
fixed: vendor fix RHSA-2025:23530
Red Hat Update Infrastructure 5 rhui5 1768221100, rhui5 1768221107, rhui5 1768296285, rhui5 1768377012
fixed: vendor fix RHSA-2026:0685

show 1 more

Red Hat Ceph Storage 8 rhceph 1768902743, rhceph 1768903190, rhceph 1768903749, rhceph 1768907469, rhceph 1768915405 Red Hat Enterprise Linux 8 scipy, python3, python36, python3.11, python3.12, python-nose, +37 more Red Hat Enterprise Linux 9 python3.11, python3.12, python3.11-idle, python3.11-libs, python3.11-test, python3.12-idle, +4 more Red Hat Enterprise Linux 10 python3.12
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-06-28)

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
OSV	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
bitnami	libpython	<3.9.24	3.9.24
bitnami	python	<3.9.24	3.9.24
bitnami	python-min	<3.9.24	3.9.24

Affected products

Python Software Foundation CPython

References

github.com /python/cpython/pull/23014
mitigation, web
github.com /python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e
patch, web
github.com /python/cpython/commit/a2cdbb6e8188ba9ba8b356b28d91bff60e86fe31
patch, web
mail.python.org /archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/
vendor-advisory, web
jbp.io /2024/06/27/cve-2024-5535-openssl-memory-safety.html
third-party-advisory, web
openwall.com /lists/oss-security/2024/06/28/4
web
github.com /python/cpython/issues/121227
issue-tracking, web
security.netapp.com /advisory/ntap-20240726-0005/
web
nvd.nist.gov /vuln/detail/CVE-2024-5642
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary