CVE-2024-0397

A defect was discovered in the Python ssl module where there is a memory
race condition with the ssl.SSLContext methods cert_store_stats() and
get_ca_certs(). The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
PSFCNA
---
---
CISA-ADPADP
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
Debian logo
Debian Releases
Debian Product
Codename
pypy3
bullseye
ignored
bookworm
no-dsa
bullseye (security)
vulnerable
trixie
7.3.19+dfsg-2
fixed
forky
7.3.20+dfsg-4
fixed
sid
7.3.20+dfsg-4
fixed
python2.7
bullseye
vulnerable
bookworm
no-dsa
python3.11
bookworm
3.11.2-6+deb12u6
no-dsa
bullseye
ignored
bookworm (security)
3.11.2-6+deb12u3
fixed
python3.13
trixie
3.13.5-2
fixed
bookworm
no-dsa
bullseye
ignored
forky
3.13.9-1
fixed
sid
3.13.9-1
fixed
python3.9
bullseye
ignored
bookworm
no-dsa
bullseye (security)
3.9.2-1+deb11u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python2.7
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
python3.4
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
trusty
needs-triage
python3.5
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
xenial
not-affected
trusty
not-affected
python3.6
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
bionic
needs-triage
python3.7
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
bionic
needs-triage
python3.8
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
Fixed 3.8.10-0ubuntu1~20.04.11
released
bionic
needs-triage
python3.9
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
needs-triage
python3.10
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
Fixed 3.10.12-1~22.04.5
released
focal
dne
python3.11
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
ignored
jammy
needs-triage
focal
dne
python3.12
questing
dne
plucky
dne
oracular
not-affected
noble
not-affected
mantic
ignored
jammy
dne
focal
dne
References