Vulnerability · Published Jun 17, 2024 · Assigned by PSF
CVE-2024-0397Memory race condition in ssl.SSLContext certificate store methods
High 7.4
In plain English
A high-severity race condition in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2024-0397 |
| Debian:13 | pypy3 | 7.3.16+dfsg-1 | DEBIAN-CVE-2024-0397 |
| Debian:14 | pypy3 | 7.3.16+dfsg-1 | DEBIAN-CVE-2024-0397 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u3 | DEBIAN-CVE-2024-0397 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u3 | DSA-5759-1 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.5 | USN-6928-1 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.5 | UBUNTU-CVE-2024-0397 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.8.203.9.0 – before 3.9.203.10.0 – before 3.10.143.11.0 – before 3.11.93.12.0 – before 3.12.33.13.0a1 – before 3.13.0a5 |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
References
- https://github.com/python/cpython/issues/114572 issue-tracking
- https://github.com/python/cpython/pull/114573 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/ vendor-advisory
- https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d patch
- https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524 patch
- https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e patch
- https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286 patch
- https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa patch
- https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab patch
- http://www.openwall.com/lists/oss-security/2024/06/17/2
- https://security.netapp.com/advisory/ntap-20250411-0006/
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html