[3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw by ambv · Pull Request #108317 · python/cpython

…ose flaw

Instances of `ssl.SSLSocket` were vulnerable to a bypass of the TLS handshake
and included protections (like certificate verification) and treating sent
unencrypted data as if it were post-handshake TLS encrypted data.

The vulnerability is caused when a socket is connected, data is sent by the
malicious peer and stored in a buffer, and then the malicious peer closes the
socket within a small timing window before the other peers’ TLS handshake can
begin. After this sequence of events the closed socket will not immediately
attempt a TLS handshake due to not being connected but will also allow the
buffered data to be read as if a successful TLS handshake had occurred.

Co-Authored-By: Gregory P. Smith [Google LLC] <greg@krypto.org>

ambv changed the title gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw [3.11] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw

ambv deleted the cve-2023-40217-3.11 branch