RHSA-2026:74599HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 1, 2026
Last Modified
October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-19553 →

📋 Description

CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products16

  • Red Hat Hardened Images
  • python3.11-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-0:3.11.16-1.5.hum1@src as a component of Red Hat Hardened Images
  • python3.11-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.11-debug-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-debug-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.11-devel-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-devel-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.11-idle-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-idle-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.11-libs-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-libs-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.11-test-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-test-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.11-tkinter-0:3.11.16-1.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.11-tkinter-0:3.11.16-1.5.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)