Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products20

• Red Hat Hardened Images
• python3.13-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-0:3.13.15-1.4.hum1@src as a component of Red Hat Hardened Images
• python3.13-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-debug-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-debug-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-devel-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-devel-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-freethreading-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-freethreading-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-freethreading-debug-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-freethreading-debug-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-idle-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-idle-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-libs-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-libs-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-test-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-test-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
• python3.13-tkinter-0:3.13.15-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
• python3.13-tkinter-0:3.13.15-1.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)

• selfhttps://access.redhat.com/errata/RHSA-2026:74605
• externalhttps://access.redhat.com/security/cve/CVE-2026-19553
• externalhttps://access.redhat.com/security/updates/classification/
• externalhttps://images.redhat.com/
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74605.json