CVE-2024-0397

EUVD-2024-16193
A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA-ADPADP
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Debian logo
Debian Releases
Debian Product
Codename
pypy3
bookworm
no-dsa
bullseye
ignored
bullseye (security)
vulnerable
forky
7.3.20+dfsg-4
fixed
sid
7.3.20+dfsg-4
fixed
trixie
7.3.19+dfsg-2
fixed
python2.7
bookworm
no-dsa
bullseye
vulnerable
python3.11
bookworm
3.11.2-6+deb12u6
no-dsa
bookworm (security)
3.11.2-6+deb12u3
fixed
bullseye
ignored
python3.13
bookworm
no-dsa
bullseye
ignored
forky
3.13.11-1
fixed
sid
3.13.11-1
fixed
trixie
3.13.5-2
fixed
python3.9
bookworm
no-dsa
bullseye
ignored
bullseye (security)
3.9.2-1+deb11u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python2.7
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
xenial
needs-triage
python3.4
focal
dne
jammy
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
python3.5
focal
dne
jammy
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
not-affected
xenial
not-affected
python3.6
bionic
needs-triage
focal
dne
jammy
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
python3.7
bionic
needs-triage
focal
dne
jammy
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
python3.8
bionic
needs-triage
focal
Fixed 3.8.10-0ubuntu1~20.04.11
released
jammy
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
python3.9
focal
needs-triage
jammy
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
python3.10
focal
dne
jammy
Fixed 3.10.12-1~22.04.5
released
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
python3.11
focal
dne
jammy
needs-triage
mantic
ignored
noble
dne
oracular
dne
plucky
dne
questing
dne
python3.12
focal
dne
jammy
dne
mantic
ignored
noble
not-affected
oracular
not-affected
plucky
dne
questing
dne
References