CVE-2024-0397

What it actually does

Memory race condition in ssl.SSLContext.cert_store_stats() and get_ca_certs() when invoked concurrently with certificate loading into the context, such as during TLS handshakes with a certificate directory configured, leading to undefined behavior, crashes, or information disclosure.

Why it matters to the business

Python-based services relying on SSL/TLS may experience unexpected crashes, service interruptions, or potential data leaks, increasing operational risk and requiring prompt updates across development and production environments.

How an attack unfolds

An attacker triggers the race by initiating TLS connections that cause certificate loading while concurrently invoking cert_store_stats() or get_ca_certs() on the same SSLContext, exploiting the timing window in the ssl module.

How to fix it

Upgrade CPython to 3.10.14, 3.11.9, 3.12.3, or 3.13.0a5 (or newer); the fix is included in commit 01c37f1d0714f5822d34063ca7180b595abf589d. Rebuild and redeploy affected applications after updating.

How to confirm the fix worked

Confirm the installed CPython version matches or exceeds a fixed release, then execute test cases that perform concurrent calls to cert_store_stats() and get_ca_certs() during TLS handshakes with certificate directories.

Typical attack path

1. Locate Python applications using the ssl module with certificate directories configured for TLS
2. Initiate concurrent TLS handshakes to trigger certificate loading into the SSLContext
3. Simultaneously call cert_store_stats() or get_ca_certs() to exploit the memory race condition

How to detect it

Review Python process logs and crash dumps for segmentation faults, memory corruption errors, or unexpected exceptions occurring during TLS handshake activity and concurrent certificate operations; correlate with high-concurrency SSL workloads.

What your security team should do

• Prioritize upgrading all CPython installations to the listed fixed versions within the next patching cycle
• Audit Python applications and libraries for direct or indirect use of the ssl module with dynamic certificate loading
• Update dependency scanning tools and CI/CD pipelines to enforce the fixed versions going forward