RHSA-2026:74587HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 1, 2026
Last Modified
October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-19553 →

📋 Description

CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products32

  • Red Hat Hardened Images
  • python-unversioned-command-0:3.14.7-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • python-unversioned-command-0:3.14.7-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • python3-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-debug-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-debug-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-devel-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-devel-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-idle-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-idle-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-libs-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-libs-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-test-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-test-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-tkinter-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-tkinter-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.14-0:3.14.7-1.3.hum1@src as a component of Red Hat Hardened Images
  • python3.14-freethreading-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-debug-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-debug-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-devel-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-devel-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-idle-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-idle-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-libs-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-libs-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-test-0:3.14.7-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.14-freethreading-test-0:3.14.7-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)