RHSA-2026:74606HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 1, 2026
Last Modified
October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-19553 →

📋 Description

CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products16

  • Red Hat Hardened Images
  • python3.12-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-0:3.12.14-1.4.hum1@src as a component of Red Hat Hardened Images
  • python3.12-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-debug-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-debug-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-devel-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-devel-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-idle-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-idle-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-libs-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-libs-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-test-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-test-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-tkinter-0:3.12.14-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-tkinter-0:3.12.14-1.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)