python3.11 安全漏洞 (CVE-2023-40217)

admin

0
文章

0
评论

2023-11-29 21:16:13 Ali_nvd 来源：ZONE.CI 全球网 0 阅读模式

中危 python3.11 安全漏洞 (CVE-2023-40217)

CVE编号

CVE-2023-40217

利用情况

暂无

补丁情况

官方补丁

披露时间

2023-08-25

漏洞描述

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
https://mail.python.org/archives/list/security-announce%40python.org/thread/P...
https://security.netapp.com/advisory/ntap-20231006-0014/
https://www.python.org/dev/security/

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	python	python	*		Up to (excluding) 3.8.18
	运行在以下环境
	应用	python	python	*	From (including) 3.10.0	Up to (excluding) 3.10.13
	运行在以下环境
	应用	python	python	*	From (including) 3.11.0	Up to (excluding) 3.11.5
	运行在以下环境
	应用	python	python	*	From (including) 3.9.0	Up to (excluding) 3.9.18
	运行在以下环境
	系统	alpine_3.15	python3	*		Up to (excluding) 3.9.18-r0
	运行在以下环境
	系统	alpine_3.16	python3	*		Up to (excluding) 3.10.13-r0
	运行在以下环境
	系统	alpine_3.17	python3	*		Up to (excluding) 3.10.13-r0
	运行在以下环境
	系统	alpine_3.18	python3	*		Up to (excluding) 3.11.5-r0
	运行在以下环境
	系统	alpine_edge	python3	*		Up to (excluding) 3.11.5-r0
	运行在以下环境
	系统	amazon_2	python3	*		Up to (excluding) 3.8.16-1.amzn2.0.5
	运行在以下环境
	系统	amazon_2023	python3.9	*		Up to (excluding) 3.11.2-2.amzn2023.0.10
	运行在以下环境
	系统	amazon_AMI	python27	*		Up to (excluding) 3.8.5-1.10.amzn1
	运行在以下环境
	系统	anolis_os_23	python3-idle	*		Up to (excluding) 3.10.13-1
	运行在以下环境
	系统	debian_10	pypy3	*		Up to (excluding) 2.7.16-2+deb10u3
	运行在以下环境
	系统	debian_11	pypy3	*		Up to (excluding) 2.7.18-8+deb11u1
	运行在以下环境
	系统	debian_12	pypy3	*		Up to (including) 3.11.2-6
	运行在以下环境
	系统	debian_sid	pypy3	*		Up to (excluding) 3.10.13-1
	运行在以下环境
	系统	kylinos_aarch64_V10	python3	*		Up to (excluding) 3.7.9-18.se.05.p06.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10HPC	python3	*		Up to (excluding) 3.9.9-24.p01.ky10h
	运行在以下环境
	系统	kylinos_aarch64_V10SP3	python3	*		Up to (excluding) 3.7.9-18.se.05.p06.ky10
	运行在以下环境
	系统	kylinos_loongarch64_V10SP1	python3	*		Up to (excluding) 3.7.9-7.p14.se.a.ky10
	运行在以下环境
	系统	kylinos_loongarch64_V10SP3	python3	*		Up to (excluding) 3.7.9-18.se.05.p06.a.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10	python3	*		Up to (excluding) 3.7.9-18.se.05.p06.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10HPC	python3	*		Up to (excluding) 3.9.9-24.p01.ky10h
	运行在以下环境
	系统	kylinos_x86_64_V10SP3	python3	*		Up to (excluding) 3.7.9-18.se.05.p06.ky10
	运行在以下环境
	系统	oracle_8	oraclelinux-release	*		Up to (excluding) 1.3.7-31.module+el8.5.0+20361+8a9d3d27
	运行在以下环境
	系统	oracle_9	oraclelinux-release	*		Up to (excluding) 3.9.16-1.el9_2.2
	运行在以下环境
	系统	redhat_8	python3.11-debugsource	*		Up to (excluding) 3.6.8-51.el8_8.2
	运行在以下环境
	系统	redhat_9	python3.11-debugsource	*		Up to (excluding) 3.9.16-1.el9_2.2
	运行在以下环境
	系统	suse_12_SP5	python36	*		Up to (excluding) 2.7.18-33.23.1
	运行在以下环境
	系统	unionos_d	python2.7	*		Up to (excluding) 3.7.3.17-1+dde
	运行在以下环境
系统	unionos_e	python3	*		Up to (excluding) python3-3.7.9-37.up2.uel20