[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4bd69014-37f2-46fc-98f2-7ade8d1bc3a8@oracle.com>
Date: Mon, 17 Jun 2024 09:31:05 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: [Security-announce][CVE-2024-0397] Memory race condition in
ssl.SSLContext certificate store methods
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2024-0397] Memory race condition in
ssl.SSLContext certificate store methods
Date: Mon, 17 Jun 2024 09:02:21 -0500
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
A defect was discovered in the Python “ssl” module where there is a memory race
condition with the ssl.SSLContext methods “cert_store_stats()” and
“get_ca_certs()”. The race condition can be triggered if the methods are called
at the same time as certificates are loaded into the SSLContext, such as during
the TLS handshake with a certificate directory configured. This issue is fixed
in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Severity: Low
References
* https://github.com/python/cpython/issues/114572
* https://github.com/python/cpython/pull/114573
View attachment "Attached Message Part" of type "text/plain" (292 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
