pyOpenSSL Buffer Overflow Vulnerability in DTLS Cookie Generation

A buffer overflow vulnerability has been identified in pyOpenSSL, a Python wrapper for the OpenSSL library. This issue affects pyOpenSSL versions 22.0.0 prior to 26.0.0. The vulnerability arises when a user-defined callback, set through the 'set_cookie_generate_callback' method, returns a cookie value exceeding 256 bytes. In such cases, pyOpenSSL would overflow a buffer provided by OpenSSL, corrupting adjacent memory.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Reproduction

To reproduce this vulnerability, set a callback for the 'set_cookie_generate_callback' that returns a value longer than 256 bytes. When the DTLS handshake is initiated, the oversized cookie will cause a buffer overflow by exceeding the allocated memory space for the cookie, potentially overwriting adjacent memory and leading to undefined behavior.

Remediation

Users can upgrade to pyOpenSSL version 26.0.0 or later, where this vulnerability has been patched.