CVE-2024-0397
Memory race condition in ssl.SSLContext certificate store methods
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Se descubrió un defecto en el módulo “ssl” de Python donde existe una condición de ejecución de memoria con los métodos ssl.SSLContext “cert_store_stats()” y “get_ca_certs()”. La condición de ejecución se puede desencadenar si los métodos se llaman al mismo tiempo que se cargan los certificados en SSLContext, como durante el protocolo de enlace TLS con un directorio de certificados configurado. Este problema se solucionó en CPython 3.10.14, 3.11.9, 3.12.3 y 3.13.0a5.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-01-10 CVE Reserved
- 2024-06-17 CVE Published
- 2024-06-18 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2024/06/17/2 |
|
|
| https://github.com/python/cpython/issues/114572 | Issue Tracking |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | < 3.8.20 Search vendor "Python Software Foundation" for product "CPython" and version " < 3.8.20" | en |
Affected
| ||||||
| Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.9.0 < 3.9.20 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.9.0 < 3.9.20" | en |
Affected
| ||||||
| Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.10.0 < 3.10.14 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.10.0 < 3.10.14" | en |
Affected
| ||||||
| Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.11.0 < 3.11.9 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.11.0 < 3.11.9" | en |
Affected
| ||||||
| Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.12.0 < 3.12.3 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.12.0 < 3.12.3" | en |
Affected
| ||||||