CVE-2024-0397
📋 TL;DR
A race condition in Python's ssl module allows concurrent calls to cert_store_stats() or get_ca_certs() while certificates are being loaded to cause memory corruption. This affects Python applications using SSL/TLS with certificate directories, potentially leading to crashes or arbitrary code execution. Systems running vulnerable Python versions with SSL/TLS enabled are at risk.
💻 Affected Systems
- Python
- Applications using Python's ssl module
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, potentially allowing full system compromise.
Likely Case
Application crashes or denial of service due to memory corruption.
If Mitigated
No impact if race condition doesn't trigger or if proper error handling exists.
🎯 Exploit Status
Exploitation requires race condition triggering during certificate loading operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Python 3.10.14, 3.11.9, 3.12.3, 3.13.0a5
Vendor Advisory: https://github.com/python/cpython/security/advisories
Restart Required: Yes
Instructions:
1. Identify Python version with 'python --version'. 2. Upgrade to patched version using package manager (apt/yum/pip) or download from python.org. 3. Restart all Python applications/services.
🔧 Temporary Workarounds
Avoid concurrent certificate operations
allPrevent calling cert_store_stats() or get_ca_certs() while certificates are being loaded.
Disable certificate directory loading
allUse static certificate configurations instead of dynamic directory loading.
🧯 If You Can't Patch
- Implement application-level locking around SSL certificate operations
- Monitor for application crashes and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check Python version and verify if using SSL/TLS with certificate directories and concurrent calls to affected methods.Check Version:
python --versionVerify Fix Applied:
Confirm Python version is 3.10.14+, 3.11.9+, 3.12.3+, or 3.13.0a5+ using 'python --version'.📡 Detection & Monitoring
Log Indicators:
- Python segmentation faults
- SSL/TLS handshake failures
- Memory corruption errors
Network Indicators:
- TLS connection resets
- Unexpected SSL/TLS protocol errors
SIEM Query:
source="*python*" AND ("segmentation fault" OR "memory corruption" OR "SSL error")🔗 References
- http://www.openwall.com/lists/oss-security/2024/06/17/2
- https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d
- https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524
- https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e
- https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286
- https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa
- https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab
- https://github.com/python/cpython/issues/114572
- https://github.com/python/cpython/pull/114573
- https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/
- http://www.openwall.com/lists/oss-security/2024/06/17/2
- https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d
- https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524
- https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e
- https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286
- https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa
- https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab
- https://github.com/python/cpython/issues/114572
- https://github.com/python/cpython/pull/114573
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/
- https://security.netapp.com/advisory/ntap-20250411-0006/
