CVE-2024-5642 Affecting pypy3 package, versions <7.3.10+dfsg-1


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.04% (13th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-PYPY3-9380626
  • published11 Mar 2025
  • disclosed27 Jun 2024

Introduced: 27 Jun 2024

CVE-2024-5642  (opens in a new tab)

How to fix?

Upgrade Debian:12 pypy3 to version 7.3.10+dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pypy3 package and not the pypy3 package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

CVSS Base Scores

version 3.1