CVE-2024-0397VulnerabilityPublished 12 Nov 2024Updated 11 Oct 2026

SUSE · security update for python3.12

Affects SUSESource GCVE Database

Mentioned vulnerabilities

Authoritative record:CVE-2024-0397· High 7.4

Not known to be exploited · CVSS 7.4 High · fixed in SUSE package updates : patch SUSE soon.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score

7.4High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.8% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 3.12.3, 3.11.9, 3.10.14

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade cpython to 3.12.3, 3.11.9 or 3.10.14.

Affected software

Product	Affected	Fixed in
PyPIcpython`pkg:pypi/cpython`Other threats	Affected <3.10.14 <3.11.9 <3.12.3 =3.13.0	Fixed in 3.10.14 3.11.9 3.12.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update is available from Red Hat for Python 3.12 on Red Hat Enterprise Linux 9 and related distributions. Users should apply the update as described in the Red Hat advisory (RHSA-2024:9190) to remediate these vulnerabilities. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigation steps are indicated beyond applying the official update.

Description

A security update for Python 3.12 addresses multiple vulnerabilities including denial of service issues related to the zipfile module and incorrect handling of IPv4 and IPv6 private ranges. The vulnerabilities fixed include CVE-2024-0450, CVE-2024-4032, and CVE-2024-8088. These issues could allow denial of service conditions when processing malicious ZIP files or incorrect IP range handling. The update is rated as having moderate security impact by Red Hat and is available for Red Hat Enterprise Linux 9 and related distributions.

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-450Multiple Interpretations of UI Input (opens in a new tab)
Base weakness
The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-440Expected Behavior Violation (opens in a new tab)
Base weakness
A feature, API, or function does not perform according to its specification.
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Oct 2026, 22:29 UTC

WeaknessesCWE-362, CWE-450, CWE-440 +1

Technical details

References

Community reviews

Related threats