{"id":"PSF-2024-4","details":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.","aliases":["BIT-libpython-2024-0397","BIT-python-2024-0397","BIT-python-min-2024-0397","CVE-2024-0397"],"modified":"2026-05-18T23:10:13.831450Z","published":"2024-06-17T15:09:40.896Z","database_specific":{"cwe_ids":[]},"references":[{"type":"REPORT","url":"https://github.com/python/cpython/issues/114572"},{"type":"WEB","url":"https://github.com/python/cpython/pull/114573"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"},{"type":"FIX","url":"https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"},{"type":"FIX","url":"https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"},{"type":"FIX","url":"https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"},{"type":"FIX","url":"https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"},{"type":"FIX","url":"https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"},{"type":"FIX","url":"https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/06/17/2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"01c37f1d0714f5822d34063ca7180b595abf589d"},{"fixed":"29c97287d205bf2f410f4895ebce3f43b5160524"},{"fixed":"37324b421b72b7bc9934e27aba85d48d4773002e"},{"fixed":"542f3272f56f31ed04e74c40635a913fbc12d286"},{"fixed":"b228655c227b2ca298a8ffac44d14ce3d22f6faa"},{"fixed":"bce693111bff906ccf9281c22371331aaff766ab"}]}],"versions":["v3.8.19","v3.9.19","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.8.18","v3.11.5","v3.9.18","v3.10.13","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.10.12","v3.12.0b2","v3.8.17","v3.9.17","v3.12.0b1","v3.10.11","v3.11.3","v3.12.0a7","v3.12.0a6","v3.10.10","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.10.9","v3.11.1","v3.8.16","v3.9.16","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.8.15","v3.10.8","v3.9.15","v3.8.14","v3.9.14","v3.10.7","v3.11.0rc1","v3.10.6","v3.11.0b5","v3.11.0b4","v3.10.5","v3.11.0b3","v3.11.0b2","v3.9.13","v3.11.0b1","v3.11.0a7","v3.10.4","v3.9.12","v3.9.11","v3.10.3","v3.8.13","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.10.2","v3.11.0a3","v3.10.1","v3.9.9","v3.9.8","v3.10.0rc2","v3.9.7","v3.8.12","v3.10.0rc1","v3.10.0b4","v3.8.11","v3.9.6","v3.10.0b3","v3.10.0b2","v3.10.0b1","v3.9.5","v3.10.0a7","v3.9.2","v3.8.8","v3.9.2rc1","v3.8.8rc1","v3.10.0a1","v3.9.0b5","v3.8.5","v3.9.0b3","v3.9.0b1","v3.8.3","v3.8.3rc1","v3.9.0a2","v3.8.0rc1","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2024-4.json","vanir_signatures_modified":"2026-05-18T23:10:13Z","vanir_signatures":[{"target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_cert_store_stats_impl"},"deprecated":false,"digest":{"function_hash":"214924729268783521281066775001235137272","length":543},"id":"PSF-2024-4-0c8cf5b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"},{"deprecated":false,"digest":{"function_hash":"267831615190247464740372781677498586151","length":803},"id":"PSF-2024-4-11b2b330","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_get_ca_certs_impl"}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_cert_store_stats_impl"},"deprecated":false,"digest":{"function_hash":"214924729268783521281066775001235137272","length":543},"id":"PSF-2024-4-1ab374ce","signature_type":"Function"},{"source":"https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_get_ca_certs_impl"},"deprecated":false,"digest":{"function_hash":"267831615190247464740372781677498586151","length":803},"id":"PSF-2024-4-2e8506ae","signature_type":"Function","signature_version":"v1"},{"target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["123530213572272044241009411496197871817","200201299181124484660293268760519148168","259695878569452326377606599870398938295","233960810333570605655484121024638076304","226970706793784016314893614203664183907","84413303792988807738388360934890567725","61618566130899658539256274858072069038","257935939472092423356717595012241358413","273044645211350846033584871890401335473","163365333947463192760216260292028193514","81477913632691801171744826625067917144","30158334562189795078273720525780082792","206178550708965781737504027480992523578","28986385988719369160723320181902825911","176618413189878984630475223888358291421","301143843603784104916942442533451237526","95497145508302319014478414429507557267","304454812945834557149447389223461706170","25875761612873731263687065831873739463","190334277521573426903605423155396613838","170106451010986521382851563875727465792","253792490082630518316939501398020113891","288983681670899251818987542178005187293"],"threshold":0.9},"id":"PSF-2024-4-346dad17","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_cert_store_stats_impl"},"deprecated":false,"digest":{"function_hash":"214924729268783521281066775001235137272","length":543},"id":"PSF-2024-4-6d4a3c26"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["123530213572272044241009411496197871817","200201299181124484660293268760519148168","259695878569452326377606599870398938295","233960810333570605655484121024638076304","226970706793784016314893614203664183907","84413303792988807738388360934890567725","61618566130899658539256274858072069038","257935939472092423356717595012241358413","273044645211350846033584871890401335473","163365333947463192760216260292028193514","81477913632691801171744826625067917144","30158334562189795078273720525780082792","206178550708965781737504027480992523578","28986385988719369160723320181902825911","176618413189878984630475223888358291421","301143843603784104916942442533451237526","95497145508302319014478414429507557267","304454812945834557149447389223461706170","25875761612873731263687065831873739463","190334277521573426903605423155396613838","170106451010986521382851563875727465792","253792490082630518316939501398020113891","288983681670899251818987542178005187293"],"threshold":0.9},"id":"PSF-2024-4-705ce908","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"267831615190247464740372781677498586151","length":803},"id":"PSF-2024-4-9e1c12dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","target":{"function":"_ssl__SSLContext_get_ca_certs_impl","file":"Modules/_ssl.c"}},{"deprecated":false,"digest":{"length":543,"function_hash":"214924729268783521281066775001235137272"},"id":"PSF-2024-4-a0742f4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","target":{"function":"_ssl__SSLContext_cert_store_stats_impl","file":"Modules/_ssl.c"}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_cert_store_stats_impl"},"deprecated":false,"digest":{"function_hash":"214924729268783521281066775001235137272","length":543},"id":"PSF-2024-4-a2884de3","signature_type":"Function"},{"id":"PSF-2024-4-a5db7515","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_get_ca_certs_impl"},"deprecated":false,"digest":{"function_hash":"265746097305689266357477981060500385376","length":761}},{"source":"https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","target":{"function":"_ssl__SSLContext_get_ca_certs_impl","file":"Modules/_ssl.c"},"deprecated":false,"digest":{"function_hash":"265746097305689266357477981060500385376","length":761},"id":"PSF-2024-4-ab2bc15d","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["123530213572272044241009411496197871817","200201299181124484660293268760519148168","259695878569452326377606599870398938295","233960810333570605655484121024638076304","226970706793784016314893614203664183907","84413303792988807738388360934890567725","61618566130899658539256274858072069038","257935939472092423356717595012241358413","273044645211350846033584871890401335473","163365333947463192760216260292028193514","81477913632691801171744826625067917144","30158334562189795078273720525780082792","206178550708965781737504027480992523578","28986385988719369160723320181902825911","176618413189878984630475223888358291421","301143843603784104916942442533451237526","95497145508302319014478414429507557267","304454812945834557149447389223461706170","25875761612873731263687065831873739463","190334277521573426903605423155396613838","170106451010986521382851563875727465792","253792490082630518316939501398020113891","288983681670899251818987542178005187293"]},"id":"PSF-2024-4-c0da2a29"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["112806490382328744708534595222546407591","262909644382450144142022125631604669440","162910182408913576601584186189158925433","220301602552249839060295597081088862747","153707601271904422264833791749340611801","153788529729825661102237166308658750590","235420969032820362900137908848947161452","293582388255842405357790219424858342210","259695878569452326377606599870398938295","207823027382081882606687849712017215685","233960810333570605655484121024638076304","226970706793784016314893614203664183907","84413303792988807738388360934890567725","61618566130899658539256274858072069038","257935939472092423356717595012241358413","273044645211350846033584871890401335473","163365333947463192760216260292028193514","81477913632691801171744826625067917144","30158334562189795078273720525780082792","206178550708965781737504027480992523578","260743894228843058800140261526602937485","28986385988719369160723320181902825911","176618413189878984630475223888358291421","301143843603784104916942442533451237526","95497145508302319014478414429507557267","304454812945834557149447389223461706170","25875761612873731263687065831873739463","190334277521573426903605423155396613838","170106451010986521382851563875727465792","253792490082630518316939501398020113891","288983681670899251818987542178005187293"],"threshold":0.9},"id":"PSF-2024-4-c6136ce2","signature_type":"Line"},{"source":"https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["123530213572272044241009411496197871817","200201299181124484660293268760519148168","259695878569452326377606599870398938295","233960810333570605655484121024638076304","226970706793784016314893614203664183907","84413303792988807738388360934890567725","61618566130899658539256274858072069038","257935939472092423356717595012241358413","273044645211350846033584871890401335473","163365333947463192760216260292028193514","81477913632691801171744826625067917144","30158334562189795078273720525780082792","206178550708965781737504027480992523578","28986385988719369160723320181902825911","176618413189878984630475223888358291421","301143843603784104916942442533451237526","95497145508302319014478414429507557267","304454812945834557149447389223461706170","25875761612873731263687065831873739463","190334277521573426903605423155396613838","170106451010986521382851563875727465792","253792490082630518316939501398020113891","288983681670899251818987542178005187293"],"threshold":0.9},"id":"PSF-2024-4-cac527a5","signature_type":"Line","signature_version":"v1"},{"id":"PSF-2024-4-de77ab70","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_get_ca_certs_impl"},"deprecated":false,"digest":{"function_hash":"267831615190247464740372781677498586151","length":803}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","target":{"file":"Modules/_ssl.c","function":"_ssl__SSLContext_cert_store_stats_impl"},"deprecated":false,"digest":{"function_hash":"214924729268783521281066775001235137272","length":543},"id":"PSF-2024-4-dfaa0359"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","target":{"file":"Modules/_ssl.c"},"deprecated":false,"digest":{"line_hashes":["112806490382328744708534595222546407591","262909644382450144142022125631604669440","162910182408913576601584186189158925433","220301602552249839060295597081088862747","153707601271904422264833791749340611801","153788529729825661102237166308658750590","235420969032820362900137908848947161452","293582388255842405357790219424858342210","259695878569452326377606599870398938295","207823027382081882606687849712017215685","233960810333570605655484121024638076304","226970706793784016314893614203664183907","84413303792988807738388360934890567725","61618566130899658539256274858072069038","257935939472092423356717595012241358413","273044645211350846033584871890401335473","163365333947463192760216260292028193514","81477913632691801171744826625067917144","30158334562189795078273720525780082792","206178550708965781737504027480992523578","260743894228843058800140261526602937485","28986385988719369160723320181902825911","176618413189878984630475223888358291421","301143843603784104916942442533451237526","95497145508302319014478414429507557267","304454812945834557149447389223461706170","25875761612873731263687065831873739463","190334277521573426903605423155396613838","170106451010986521382851563875727465792","253792490082630518316939501398020113891","288983681670899251818987542178005187293"],"threshold":0.9},"id":"PSF-2024-4-e4d6f5de","signature_type":"Line"}]}}],"schema_version":"1.7.5"}