Skip to content
Appaloosa Scout
Language selector
fr en

Vulnerability · NVD

CVE-2023-40217

CVE-2023-40217, rated medium by the vendor: 3 tracked apps concerned, all fixed or indeterminable on their current version.

Severity (CVSS)
5.3

Base CVSS ; severity is a vendor rating (different scale)

Exploitation
0.8 %

EPSS, predicted over 30 days

Tracked apps
3
Still exposed
0
Vendor bulletin scale : NVD CVSS pending

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

Attack vector : Network No privileges required No user interaction
Show raw CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS 0.80% above median percentile 54.8%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • Python 3.12 Windows winget:Python.Python.3.12
    Affected <3.8.18 Fixed in 3.8.18 Latest tracked 3.12.10 patched
  • Python 3.13 Windows winget:Python.Python.3.13
    Affected <3.8.18 Fixed in 3.8.18 Latest tracked 3.13.15 patched
  • Python 3.14 Windows winget:Python.Python.3.14
    Affected <3.8.18 Fixed in 3.8.18 Latest tracked 3.14.7 patched
Vulnerable CPE configurations (4)
Vendor Product Versions
python python
All platforms (wildcard)
 <3.8.18
python python
All platforms (wildcard)
 ≥3.9.0 <3.9.18
python python
All platforms (wildcard)
 ≥3.10.0 <3.10.13
python python
All platforms (wildcard)
 ≥3.11.0 <3.11.5
View on NVD ↗ Advisory · www.python.org

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM