CVE-2024-5642

What it actually does

Configuring an empty list for SSLContext.set_npn_protocols() in CPython 3.9 and earlier passes an invalid value to the OpenSSL NPN API, resulting in a buffer over-read during protocol negotiation.

Why it matters to the business

Limited risk of information disclosure or application instability in network services that rely on the rarely used NPN feature; most environments remain unaffected.

How an attack unfolds

An attacker supplies or triggers an empty protocol list via set_npn_protocols() in a vulnerable Python application, causing the NPN code path to perform an out-of-bounds read when negotiating TLS connections.

How to fix it

Upgrade CPython source to commit 39258d3595300bc7b952854c915f63ae2d4b9c3e or later; ensure applications never pass an empty list to set_npn_protocols().

How to confirm the fix worked

Confirm set_npn_protocols rejects empty lists with an error; run regression tests exercising NPN code paths after applying the fix.

Typical attack path

1. Locate Python applications using SSLContext and NPN
2. Invoke or force set_npn_protocols with an empty list
3. Initiate a TLS handshake that exercises the NPN code path
4. Observe memory disclosure or crash from the resulting over-read

How to detect it

Search application and system logs for crashes or errors tied to SSL NPN negotiation; inspect source code for set_npn_protocols calls passing empty lists.

What your security team should do

• Apply the upstream commit or equivalent patch to all affected CPython installations
• Audit codebases for direct calls to set_npn_protocols with empty arguments
• Disable NPN support where it is not explicitly required