CVE-2024-0397

HIGH7.4EPSS 0.40%

python3.11 - security update

Published: 6/17/2024Modified: 3/9/2026

Also known as:DSA-5759-1DEBIAN-CVE-2024-0397DEBIAN-CVE-2024-4032DEBIAN-CVE-2024-8088

Description

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0.

Affected packages (8)

Bitnami/libpythonfrom 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.14, >= 3.11.0, < 3.11.9, >= 3.12.0, < 3.12.3
Bitnami/pythonfrom 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.14, >= 3.11.0, < 3.11.9, >= 3.12.0, < 3.12.3
Bitnami/python-minfrom 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.14, >= 3.11.0, < 3.11.9, >= 3.12.0, < 3.12.3
Debian/pypy3from 0
Debian/python2.7from 0
Debian/python3.11from 0, < 3.11.2-6+deb12u3
Debian/python3.11from 0, < 3.11.2-6+deb12u3
Debian/python3.9from 0, < 3.9.2-1+deb11u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

Affected packages (8)

CVSS scores

References (14)