CVE Feed

    Dashboard / CVE / CVE-2024-0397

    CVE-2024-0397

    A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

    Published:Jun 17, 2024
    Last Modified:Apr 15, 2026
    EPS:Jun 17, 2024
    EPSS Score:0.00384
    CVSS Score:7.4

    Affected Products

    Vendor
    Python Software Foundation
    Product
    Cpython
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-6075 (CVSS 1.8) — If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when exp…
    CVE-2024-12254 (CVSS 8.7) — Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing…
    CVE-2024-11168 (CVSS 6.3) — The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hos…
    CVE-2024-8088 (CVSS 8.7) — There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note t…
    CVE-2024-3219 (CVSS 5.1) — The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that d…
    CVE-2023-6597 (CVSS 7.8) — An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.…

    References

    http://www.openwall.com/lists/oss-security/2024/06/17/2
    https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d
    https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524
    https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e
    https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286
    https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa
    https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab
    https://github.com/python/cpython/issues/114572
    https://github.com/python/cpython/pull/114573
    https://mail.python.org/archives/list/[email protected]/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/
    http://www.openwall.com/lists/oss-security/2024/06/17/2
    https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d
    https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524
    https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e
    https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286
    https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa
    https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab
    https://github.com/python/cpython/issues/114572
    https://github.com/python/cpython/pull/114573
    https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
    https://mail.python.org/archives/list/[email protected]/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/
    https://security.netapp.com/advisory/ntap-20250411-0006/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High