CVE-2024-0397VulnerabilityPublished 12 Nov 2024Updated 11 Oct 2026

SUSE · security update for python3.11

Affects SUSESource GCVE Database

Mentioned vulnerabilities

Authoritative record:CVE-2024-0397· High 7.4

Not known to be exploited · CVSS 7.4 High : upgrade the Red Hat redhat/python3.11 package to 9.5.0 soon.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score

7.4High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.8% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 9.5.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade the Red Hat redhat/python3.11 package to 9.5.0.

Affected software

Product	Affected	Fixed in
Red Hatredhat/python3.11`pkg:rpm/redhat/python3.11`Other threats	Affected <9.5.0	Fixed in 9.5.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update for python3.11 is available from Red Hat and should be applied to affected systems. The vendor advisory (RHSA-2024:9192) provides detailed instructions for patching. Applying this update mitigates the zip-bomb and malicious ZIP iteration denial of service vulnerabilities. No additional action is required beyond installing the official patch.

Description

A security update for python3.11 addresses vulnerabilities in the zipfile module that could lead to denial of service conditions. Specifically, CVE-2024-0450 involves zip-bomb vulnerabilities, and CVE-2024-8088 concerns denial of service caused by iterating over malicious ZIP files. These issues affect Red Hat Enterprise Linux 9 and related distributions. The update is rated as having moderate security impact and a patch is available.

Impact

Successful exploitation of these vulnerabilities may cause denial of service by exhausting system resources when processing specially crafted ZIP files. This could disrupt applications or services relying on Python's zipfile module. There is no indication of code execution or data compromise. The impact is limited to service availability degradation.

Summary

This update fixes two denial of service vulnerabilities in the Python 3.11 zipfile module. CVE-2024-0450 addresses a zip-bomb vulnerability that can cause resource exhaustion. CVE-2024-8088 involves denial of service triggered by iterating over a malicious ZIP file. The vulnerabilities affect Python 3.11 packages distributed with Red Hat Enterprise Linux 9 and related variants. Red Hat has released patched versions as part of their 9.5 update. The vendor advisory confirms the availability of fixes and provides detailed instructions for applying the update.

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-450Multiple Interpretations of UI Input (opens in a new tab)
Base weakness
The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Oct 2026, 22:29 UTC

WeaknessesCWE-362, CWE-450, CWE-835

Technical details

References

Community reviews

Related threats