Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0397: A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "cert_store_stats()" and "get_ca_certs()". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python-unversioned-command | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3 | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3-debug | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3-devel | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3-idle | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3-libs | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3-test | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3-tkinter | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3.9-debuginfo | 0:3.9.16-1.amzn2023.0.9 |
| Amazon Linux · 2023 | python3.9-debugsource | 0:3.9.16-1.amzn2023.0.9 |
Vulnerabilities 1
-
High 7.4
Memory race condition in ssl.SSLContext certificate store methods
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-0397.html