A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-699 advisory.

    A defect was discovered in the Python ssl module where there is a memoryrace condition with the     ssl.SSLContext methods cert_store_stats() andget_ca_certs(). The race condition can be triggered if     the methods arecalled at the same time as certificates are loaded into the SSLContext,such as during the     TLS handshake with a certificate directory configured.This issue is fixed in CPython 3.10.14, 3.11.9,     3.12.3, and 3.13.0a5. (CVE-2024-0397)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0397 advisory.

  - A defect was discovered in the Python ssl module where there is a memory race condition with the     ssl.SSLContext methods cert_store_stats() and get_ca_certs(). The race condition can be triggered if     the methods are called at the same time as certificates are loaded into the SSLContext, such as during the     TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9,     3.12.3, and 3.13.0a5. (CVE-2024-0397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6928-1 advisory.

    It was discovered that the Python ssl module contained a memory race condition when handling the APIs to     obtain the CA certificates and certificate store statistics. This could possibly result in applications     obtaining wrong results, leading to various SSL issues. (CVE-2024-0397)

    It was discovered that the Python ipaddress module contained incorrect information about which IP address     ranges were considered private or globally reachable. This could possibly result in applications     applying incorrect security policies. (CVE-2024-4032)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2572-1 advisory.

    - CVE-2024-4032: Corrected information about public and private IPv4       and IPv6 address ranges (bsc#1226448).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Netty project is an event-driven asynchronous network application framework. In versions prior to     4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an     infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a     custom HaProxyMessageDecoder. (CVE-2022-41881)

  - Netty project is an event-driven asynchronous network application framework. Starting in version     4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of     values, header value validation was not performed, allowing malicious header values in the iterator to     perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work     around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a     `remove()` call, and call `add()` in a loop over the iterator of values. (CVE-2022-41915)

  - A defect was discovered in the Python ssl module where there is a memory race condition with the     ssl.SSLContext methods cert_store_stats() and get_ca_certs(). The race condition can be triggered if     the methods are called at the same time as certificates are loaded into the SSLContext, such as during the     TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9,     3.12.3, and 3.13.0a5. (CVE-2024-0397)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2479-1 advisory.

    - CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number     (bsc#1219559).
    - CVE-2024-0450: Fixed detecting the vulnerability of 'quoted-overlap' zipbomb (bsc#1221854).
    - CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
    - CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2280-1 advisory.

    - CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
    - CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2274-1 advisory.

    - CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
    - CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205089	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2024-699)	Nessus	Amazon Linux Local Security Checks	high
205075	CBL Mariner 2.0 Security Update: python3 (CVE-2024-0397)	Nessus	MarinerOS Local Security Checks	high
204858	Ubuntu 20.04 LTS / 22.04 LTS : Python vulnerabilities (USN-6928-1)	Nessus	Ubuntu Local Security Checks	high
203000	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2024:2572-1)	Nessus	SuSE Local Security Checks	high
202724	Oracle Database Server (Jul 2024 CPU)	Nessus	Databases	high
202464	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python3 (SUSE-SU-2024:2479-1)	Nessus	SuSE Local Security Checks	high
201322	SUSE SLES15 / openSUSE 15 Security Update : python39 (SUSE-SU-2024:2280-1)	Nessus	SuSE Local Security Checks	high
201316	SUSE SLES12 Security Update : python39 (SUSE-SU-2024:2274-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-0397

high

Tenable Plugins

high

high

high

high

high

high

high

high