jbp.io :: CVE-2024-5535: `SSL_select_next_proto` buffer overread
27 June 2024
CVE-2024-5535: `SSL_select_next_proto` buffer overread
celebrating a decade of publishing your heap over the internet
Since 2011, a bug has existed in OpenSSL that means innocuous code like:
require('tls').connect({port: 443, NPNProtocols: new Uint8Array()}, function(c) {})
or (equivalently, in Python):
import ssl, socket
assert ssl.HAS_NPN
ctx = ssl.create_default_context()
ctx.set_npn_protocols([])
ctx.load_verify_locations('root.crt')
sock = socket.create_connection(('127.0.0.1',...
Read more at jbp.io
© News Score score the news, sort the news, rewrite the headlines