CVE-2024-0397

A vulnerability was found in Python. A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time that certificates are loaded into the SSLContext, such as during the TLS handshake with a configured certificate directory.

This vulnerability is classified as low severity instead of moderate because it primarily results in a race condition that can cause unexpected behavior or crashes but does not directly lead to memory corruption, information disclosure, or remote code execution.

The issue is constrained to scenarios where multiple threads interact with SSLContext during certificate loading, which is an uncommon pattern in typical applications. Additionally, exploitation would require precise timing and a specific application design that exposes these methods to concurrent access, reducing the likelihood of real-world impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.