CVE-2024-5642

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Security Fix(es):

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).(CVE-2024-5642)

Security Fix(es):

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).(CVE-2024-5642)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)

• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)

• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)

• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)

• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)

• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)

• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)
• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)
• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

• CVE-2025-1795: fix incorrect parsing of email addresses with special chars
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with non-strict error handler
• CVE-2025-6069: fix quadratic complexity in HTMLParser special input
• CVE-2025-8291: fix zip64 end-of-central-directory record validation
• CVE-2025-11468: fix incorrect parsing of empty email display names
• CVE-2025-15282: fix control character injection in data: URL mediatype in urllib.request.DataHandler
• CVE-2024-5642: fix buffer over-read in ssl.SSLContext.set_npn_protocols with empty list

• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update()
• CVE-2026-0672: reject control characters in http.cookies.Morsel
• CVE-2025-8291: check consistency of zip64 end of central directory record
• CVE-2025-6069: fix quadratic complexity in processing special input in HTMLParser
• CVE-2025-4516: fix use-after-free in the unicode-escape decoder with error handler
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2025-11468: preserve parenthesis when folding email comments
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2024-5642: disallow setting an empty list for ssl NPN protocols

These are all security issues fixed in the python39-3.9.19-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python38-3.8.19-7.1 package on the GA media of openSUSE Tumbleweed.

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Root has patched CVE-2024-5642 in the python3.9 package for Root:Debian:11. Multiple fixed versions available.

This update for python39 fixes the following issues:

Security issues fixed:

• CVE-2024-6923: Fixed email header injection due to unquoted newlines (bsc#1228780)
• CVE-2024-5642: Removed support for anything but OpenSSL 1.1.1 or newer (bsc#1227233)

Non-security issues fixed:

• Fixed executable bits for /usr/bin/idle* (bsc#1227378).
• Improve python reproducible builds (bsc#1227999)

This update for python3 fixes the following issues:

• CVE-2024-5642: buffer overread when NPN is used and invalid values are sent to the OpenSSL API. (bsc#1227233)

This update for python36 fixes the following issues:

• CVE-2024-5642: Fixed invalid value sent to underlying OpenSSL API may cause a buffer overread when NPN is used (bsc#1227233)

This update for python3 fixes the following issues:

• CVE-2024-6923: Fixed uncontrolled CPU resource consumption when in http.cookies module (bsc#1228780).
• CVE-2024-5642: Fixed buffer overread when NPN is used and invalid values are sent to the OpenSSL API (bsc#1227233).
• CVE-2024-7592: Fixed Email header injection due to unquoted newlines (bsc#1229596).
• CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)

Bug fixes:

• %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999).
• Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).
• Remove %suse_update_desktop_file macro as it is not useful any more.