CVE-2024-0397 Memory race condition in ssl.SSLContext certificate store methods
A race condition in Python's ssl module can cause crashes when certificate store methods are called concurrently with certificate loading.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-0397?
CVE-2024-0397 is a high-severity vulnerability in CPython, published on 17 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Weakness: CWE-362
Which versions are affected by CVE-2024-0397?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.8.20, 3.9.20, 3.10.14, 3.11.9, 3.12.3 |
python Bitnami | All versions | 3.8.20, 3.9.20, 3.10.14, 3.11.9, 3.12.3 |
python-min Bitnami | All versions | 3.8.20, 3.9.20, 3.10.14, 3.11.9, 3.12.3 |
Linux distribution packages (3)
python310 openSUSE:Tumbleweed | All versions | 3.10.14-2.1 |
python38 openSUSE:Tumbleweed | All versions | 3.8.19-3.1 |
python39 openSUSE:Tumbleweed | All versions | 3.9.19-2.1 |
How do I fix CVE-2024-0397?
Upgrade libpython to a fixed version for your release line: 3.8.20, 3.9.20, 3.10.14 or 3.11.9.
Is CVE-2024-0397 being exploited?
There is no known exploitation of CVE-2024-0397 in the wild and no public exploit code.
Sources
Also known as AZL-42784, AZL-42796, BIT-libpython-2024-0397, BIT-python-2024-0397, BIT-python-min-2024-0397, CLSA-2025-1751144408 and 8 more.