CVE-2024-0397
published 2024-06-17CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and…
PriorityP341high7.4CVSS 3.1
AVNACHPRNUINSUCHINAH
EPSS
0.81%
52.8th percentile
A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < pypy3 7.3.16+dfsg-1 (forky) | pypy3 7.3.16+dfsg-1 (forky) |
| debian | python2.7 | < pypy3 7.3.16+dfsg-1 (forky) | pypy3 7.3.16+dfsg-1 (forky) |
| debian | python3.11 | < pypy3 7.3.16+dfsg-1 (forky) | pypy3 7.3.16+dfsg-1 (forky) |
| debian | python3.13 | < pypy3 7.3.16+dfsg-1 (forky) | pypy3 7.3.16+dfsg-1 (forky) |
| debian | python3.9 | < pypy3 7.3.16+dfsg-1 (forky) | pypy3 7.3.16+dfsg-1 (forky) |
| msrc | azl3_python3_3.12.0-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.3-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| python_software_foundation | cpython | < 3.8.20 | 3.8.20 |
| python_software_foundation | cpython | >= 3.10.0 < 3.10.14 | 3.10.14 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.9 | 3.11.9 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.3 | 3.12.3 |
| python_software_foundation | cpython | >= 3.13.0a1 < 3.13.0a5 | 3.13.0a5 |
| python_software_foundation | cpython | >= 3.9.0 < 3.9.20 | 3.9.20 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
osv7.4HIGH
vendor_debian7.4HIGH
vendor_msrc7.4HIGH
vendor_redhat7.4HIGH
vendor_ubuntu7.4HIGH
vendor_oracle4.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-30·CVSS 7.4
CVE-2024-0397 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that the Python ssl module contained a memory race
condition when handling the APIs to obtain the CA certificates and
certificate store statistics. This could possibly result in applications
obtaining wrong results, leading to various SSL issues. (CVE-2024-0397)
It was discovered that the Python ipaddress module contained incorrect
information about which IP address ranges were considered "private" or
"globally reachable". This could possibly result in applications applying
incorrect security policies. (CVE-2024-4032)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Database Server Risk Matrix: OML4Py (Python) — CVE-2024-0397
vendor_oracle·2024-07-15·CVSS 4.3
CVE-2024-0397 [HIGH] Oracle Oracle Database Server Risk Matrix: OML4Py (Python) — CVE-2024-0397
Oracle Oracle Database Server Risk Matrix: OML4Py (Python) vulnerability
CVE: CVE-2024-0397
CVSS: 4.3
Protocol: HTTPS
Remote exploit: No
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Red Hat
cpython: python: Memory race condition in ssl.SSLContext certificate store methods
vendor_redhat·2024-06-17·CVSS 7.4
CVE-2024-0397 [HIGH] CWE-362 cpython: python: Memory race condition in ssl.SSLContext certificate store methods
cpython: python: Memory race condition in ssl.SSLContext certificate store methods
A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
A vulnerability was found in Python. A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same tim
Microsoft
Memory race condition in ssl.SSLContext certificate store methods
vendor_msrc·2024-06-11·CVSS 7.4
CVE-2024-0397 [HIGH] CWE-362 Memory race condition in ssl.SSLContext certificate store methods
Memory race condition in ssl.SSLContext certificate store methods
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:/
Debian
CVE-2024-0397: pypy3 - A defect was discovered in the Python “ssl” module where there is a memory race ...
vendor_debian·2024·CVSS 7.4
CVE-2024-0397 [HIGH] CVE-2024-0397: pypy3 - A defect was discovered in the Python “ssl” module where there is a memory race ...
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 7.3.16+dfsg-1)
sid: resolved (fixed in 7.3.16+dfsg-1)
trixie: resolved (fixed in 7.3.16+dfsg-1)
OSV
python3.10, python3.8 vulnerabilities
osv·2024-07-30·CVSS 7.4
CVE-2024-0397 [HIGH] python3.10, python3.8 vulnerabilities
python3.10, python3.8 vulnerabilities
It was discovered that the Python ssl module contained a memory race
condition when handling the APIs to obtain the CA certificates and
certificate store statistics. This could possibly result in applications
obtaining wrong results, leading to various SSL issues. (CVE-2024-0397)
It was discovered that the Python ipaddress module contained incorrect
information about which IP address ranges were considered "private" or
"globally reachable". This could possibly result in applications applying
incorrect security policies. (CVE-2024-4032)
GHSA
GHSA-xhf3-pp4q-gxh5: A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl
ghsa_unreviewed·2024-06-17
CVE-2024-0397 [HIGH] CWE-362 GHSA-xhf3-pp4q-gxh5: A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl
A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
OSV
CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl
osv·2024-06-17·CVSS 7.4
CVE-2024-0397 [HIGH] CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2024/06/17/2https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589dhttps://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002ehttps://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faahttps://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766abhttps://github.com/python/cpython/issues/114572https://github.com/python/cpython/pull/114573https://mail.python.org/archives/list/[email protected]/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/http://www.openwall.com/lists/oss-security/2024/06/17/2https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589dhttps://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002ehttps://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faahttps://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766abhttps://github.com/python/cpython/issues/114572https://github.com/python/cpython/pull/114573https://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://mail.python.org/archives/list/[email protected]/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/https://security.netapp.com/advisory/ntap-20250411-0006/
2024-06-17
Published