CVE-2023-40217

Summary

CVE-2023-40217 is a vulnerability affecting several versions of Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. This issue primarily impacts servers using TLS client authentication. When a TLS server-side socket is created, data is received, and then closed rapidly, the SSLSocket instance will wrongly assume the socket is not connected, bypassing the initiation of a handshake. However, data readable from the socket buffer, which is not authenticated during client certificate authentication, remains accessible. The vulnerability does not enable direct data exfiltration through the TLS connection, as it requires the connection to be closed upon initialization of the SSLSocket.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.