BIT-libpython-2024-0397: Memory race condition in ssl.SSLContext certificate store methods

Q: What conditions are required to trigger the race condition?

The affected SSLContext methods cert_store_stats() or get_ca_certs() must be called concurrently while certificates are being loaded into the same SSLContext. One described scenario is a TLS handshake using a configured certificate directory.

Q: Which CPython releases contain the fix?

The issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

Q: Is network access alone sufficient to exploit this issue?

The supplied severity vector indicates network attack vector and no required privileges or user interaction, but exploitation has high attack complexity. The described trigger still depends on concurrent certificate-store method calls and certificate loading.

Published Jun 17, 2024

Updated

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “certstorestats()” and “getcacerts()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

Affected Software

1 affected component

Python Software Foundation CPython<3.10.14, <3.11.9, <3.12.3, <3.13.0a5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.10.14
Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.11.9
Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.12.3
Upgrade
Upgrade CPython to a version that resolves this vulnerability.
Fixed in 3.13.0a5

Event History

Jun 17, 2024

CVE Published

via OSV·03:09 PM

Data Sourced

via OSV·03:09 PM

DescriptionSeverity

Frequently Asked Questions

What conditions are required to trigger the race condition?

The affected SSLContext methods cert_store_stats() or get_ca_certs() must be called concurrently while certificates are being loaded into the same SSLContext. One described scenario is a TLS handshake using a configured certificate directory.

Which CPython releases contain the fix?

The issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

Is network access alone sufficient to exploit this issue?

The supplied severity vector indicates network attack vector and no required privileges or user interaction, but exploitation has high attack complexity. The described trigger still depends on concurrent certificate-store method calls and certificate loading.

BIT-libpython-2024-0397: Memory race condition in ssl.SSLContext certificate store methods

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the race condition?

Which CPython releases contain the fix?

Is network access alone sufficient to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the race condition?

Which CPython releases contain the fix?

Is network access alone sufficient to exploit this issue?