7.4

CVE-2024-0397

Memory race condition in ssl.SSLContext certificate store methods

A defect was discovered in the Python “ssl” module where there is a memory
race condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are
called at the same time as certificates are loaded into the SSLContext,
such as during the TLS handshake with a certificate directory configured.
This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellerpython_software_foundation
≫
Produkt cpython
Default Statusunaffected
Version 0
Version < 3.8.20
Status affected
Version 3.9.0
Version < 3.9.20
Status affected
Version 3.10.0
Version < 3.10.14
Status affected
Version 3.11.0
Version < 3.11.9
Status affected
Version 3.12.0
Version < 3.12.3
Status affected
Version 3.13.0a1
Version < 3.13.0a5
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.8% 0.519
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

http://www.openwall.com/lists/oss-security/2024/06/17/2
https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d
https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524
https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e
https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286
https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa
https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab
https://github.com/python/cpython/issues/114572
https://github.com/python/cpython/pull/114573
https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/
https://security.netapp.com/advisory/ntap-20250411-0006/
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html