In Python “ssl” module related to a memory race condition with the methods “cert_store_stats()” and “get_ca_certs()” in ssl.SSLContext vulnerability CVE-2024-0397 was detected. This issue can arise if these methods are used while certificates are being loaded into the SSLContext, such as during a TLS handshake with a configured certificate directory. The issue is fixed in Python versions 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-0397.
Python: Memory Race Condition in Python’s ssl.SSLContext
by the Hossted team
26.06.2024