CVE-2024-0397: Memory race condition in ssl.SSLContext certificate store methods
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “certstorestats()” and “getcacerts()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Other sources
Memory race condition in ssl.SSLContext certificate store methods
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.16+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
CPythonto a version that resolves this vulnerability.Fixed in 3.10.14 - Upgrade
Upgrade
CPythonto a version that resolves this vulnerability.Fixed in 3.11.9 - Upgrade
Upgrade
CPythonto a version that resolves this vulnerability.Fixed in 3.12.3 - Upgrade
Upgrade
CPythonto a version that resolves this vulnerability.Fixed in 3.13.0a5
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0397?
CVE-2024-0397 is classified as a medium severity vulnerability due to the potential for a memory race condition.
What kind of issue does CVE-2024-0397 involve?
CVE-2024-0397 involves a memory race condition in the Python 'ssl' module affecting SSLContext methods.
How do I fix CVE-2024-0397?
To fix CVE-2024-0397, upgrade to Python versions 3.11.2-6+deb12u3, 3.12.6-1, or 3.13.0-1 or later.
Which Python versions are affected by CVE-2024-0397?
CVE-2024-0397 affects Python 2.7, and Python 3 versions up to 3.11.2-6+deb12u2, 3.9.2-1.
Are there any known exploit scenarios for CVE-2024-0397?
As of now, there are no publicly known exploit scenarios for CVE-2024-0397, but the race condition could lead to unpredictable behavior.