CVE-2024-0397 Memory race condition in ssl.SSLContext certificate store methods

2024-06-1715:09:40

PSF

www.cve.org

python

ssl module

memory race condition

sslcontext

cpython 3.10.14

tls handshake

0.0004 Low

EPSS

Percentile

13.1%

JSON

A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPython",
    "repo": "https://github.com/python/cpython",
    "vendor": "Python Software Foundation",
    "versions": [
      {
        "lessThan": "3.13.0a5",
        "status": "affected",
        "version": "3.13.0a1",
        "versionType": "python"
      },
      {
        "lessThan": "3.12.3",
        "status": "affected",
        "version": "3.12.0",
        "versionType": "python"
      },
      {
        "lessThan": "3.11.9",
        "status": "affected",
        "version": "3.11.0",
        "versionType": "python"
      },
      {
        "lessThan": "3.10.14",
        "status": "affected",
        "version": "0",
        "versionType": "python"
      }
    ]
  }
]