{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-0397", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2024-01-10T14:05:31.635Z", "datePublished": "2024-06-17T15:09:40.896Z", "dateUpdated": "2024-09-17T18:24:43.948Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [ { "version": "0", "lessThan": "3.8.20", "status": "affected", "versionType": "python" }, { "version": "3.9.0", "lessThan": "3.9.20", "status": "affected", "versionType": "python" }, { "version": "3.10.0", "lessThan": "3.10.14", "status": "affected", "versionType": "python" }, { "version": "3.11.0", "lessThan": "3.11.9", "status": "affected", "versionType": "python" }, { "version": "3.12.0", "lessThan": "3.12.3", "status": "affected", "versionType": "python" }, { "version": "3.13.0a1", "lessThan": "3.13.0a5", "status": "affected", "versionType": "python" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5." } ], "value": "A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5." } ], "providerMetadata": { "orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2024-09-07T02:44:08.540Z" }, "references": [ { "tags": [ "issue-tracking" ], "url": "https://github.com/python/cpython/issues/114572" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/pull/114573" }, { "tags": [ "vendor-advisory" ], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa" }, { "tags": [ "patch" ], "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab" }, { "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2" } ], "source": { "discovery": "UNKNOWN" }, "title": "Memory race condition in ssl.SSLContext certificate store methods", "x_generator": { "engine": "Vulnogram 0.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" } ] } ], "affected": [ { "vendor": "python_software_foundation", "product": "cpython", "cpes": [ "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "3.8.20", "versionType": "python" }, { "version": "3.9.0", "status": "affected", "lessThan": "3.9.20", "versionType": "python" }, { "version": "3.10.0", "status": "affected", "lessThan": "3.10.14", "versionType": "python" }, { "version": "3.11.0", "status": "affected", "lessThan": "3.11.9", "versionType": "python" }, { "version": "3.12.0", "status": "affected", "lessThan": "3.12.3", "versionType": "python" }, { "version": "3.13.0a1", "status": "affected", "lessThan": "3.13.0a5", "versionType": "python" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-20T15:52:27.499743Z", "id": "CVE-2024-0397", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-17T18:24:43.948Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:04:49.771Z" }, "title": "CVE Program Container", "references": [ { "tags": [ "issue-tracking", "x_transferred" ], "url": "https://github.com/python/cpython/issues/114572" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/pull/114573" }, { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab" }, { "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2", "tags": [ "x_transferred" ] } ] } ] }, "dataVersion": "5.1" }