Loading vulnerability…
TLS Client Authentication Bypass in Python SSLSocket
CVE-2023-40217 is a TLS handshake bypass vulnerability in Python's ssl.SSLSocket affecting Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. During socket initialization, a connection that receives data and closes sufficiently quickly can be detected as disconnected, causing SSLSocket to skip the TLS handshake while leaving buffered data readable. Servers expecting TLS client certificate authentication can consequently receive unauthenticated data that is indistinguishable to the application from valid TLS stream data. The accepted data is limited to the socket buffer capacity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can bypass TLS client certificate authentication and cause a vulnerable server to read attacker-controlled buffered data without completing a TLS handshake. Application-level consequences depend on how the server processes that data. The affected connection cannot directly support data exfiltration because exploitation requires it to be closed during SSLSocket initialization. Arbitrary code execution and denial of service are not established consequences of this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Apply the relevant interpreter, distribution-package, or vendor-product update rather than relying on TLS client certificate authentication alone on an affected server.
Patch, then assume compromise.
Upgrade Python to a supported release containing the fix. The first fixed releases in the affected Python 3 branches are 3.8.18, 3.9.18, 3.10.13, and 3.11.5. Distribution packages with backported fixes are also suitable: Debian fixes include python2.7 2.7.16-2+deb10u3 for Debian 10, python3.9 3.9.2-1+deb11u2 for Debian 11, and pypy3 7.3.5+dfsg-2+deb11u3 for Debian 11. For affected containerized deployments, install vendor-updated images and rebuild dependent images.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.