CVE-2024-0397
High
Description
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
SeverityHigh
CVSS7.4
Exploit probability—
ProductCPython
PublishedJun 17, 2024
First seenJun 17, 2024
Weakness typeCWE-362Race condition
How to fix
Update
- Python Software Foundation CPython3.8.20, 3.9.20, 3.10.14, 3.11.9, 3.12.3, 3.13.0a5 or later
Patches
- github.com/python/cpython/pull/114573
- github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d
- github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524
- github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e
- github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286
- github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa
- github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.8.20, 3.9.0 ≤ v < 3.9.20, 3.10.0 ≤ v < 3.10.14, 3.11.0 ≤ v < 3.11.9, 3.12.0 ≤ v < 3.12.3, 3.13.0a1 ≤ v < 3.13.0a5 | 3.8.20, 3.9.20, 3.10.14, 3.11.9, 3.12.3, 3.13.0a5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.