René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CVE-2023-40217: Bypass TLS handshake on closed sockets","articleBody":"# Bug report\r\n\r\nOriginally reported by @AapoOksman via the [Python Security Response Team](https://www.python.org/dev/security/) mailing list on 2023-08-08. Thanks for the responsible disclosure!\r\n\r\n### Checklist\r\n\r\n- [X] I am confident this is a bug in CPython, not a bug in a third-party project\r\n- [X] I have searched the [CPython issue tracker](https://github.com/python/cpython/issues?q=is%3Aissue+sort%3Acreated-desc),\r\nand am confident this bug has not been reported before\r\n\r\n### CPython versions tested on:\r\n\r\n3.8, 3.9, 3.10, 3.11, 3.12, CPython main branch\r\n\r\n### Operating systems tested on:\r\n\r\nLinux, macOS\r\n\r\n### A clear and concise description of the bug:\r\n\r\nInstances of ssl.SSLSocket are vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and could lead applications to treat unencrypted data received pre-TLS-handshake that is followed by an immediate connection close as if it were post-handshake TLS encrypted data.\r\n\r\n\r\n\u003c!-- gh-linked-prs --\u003e\r\n### Linked PRs\r\n* gh-108315\r\n* gh-108316\r\n* gh-108317\r\n* gh-108318\r\n* gh-108320\r\n* gh-108321\r\n* gh-110718\n\u003c!-- /gh-linked-prs --\u003e\r\n","author":{"url":"https://github.com/ambv","@type":"Person","name":"ambv"},"datePublished":"2023-08-22T15:34:45.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":11},"url":"https://github.com/108310/cpython/issues/108310"}