RHSA-2026:77020HighCVSS 8.1

Red Hat Security Advisory: python3.12 security update

Published
October 8, 2026
Last Modified
October 9, 2026

🔗 CVE IDs covered (2)

CVE-2026-19445 →CVE-2026-19553 →

📋 Description

CVE-2026-19445 — python: Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

🎯 Affected products57

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python-unversioned-command-0:3.12.15-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-0:3.12.15-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-0:3.12.15-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-debug-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-debug-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-debug-0:3.12.15-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-debug-0:3.12.15-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-devel-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-devel-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-devel-0:3.12.15-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-devel-0:3.12.15-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-idle-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-idle-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-idle-0:3.12.15-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-idle-0:3.12.15-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-libs-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-libs-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-libs-0:3.12.15-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-libs-0:3.12.15-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-test-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-test-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-test-0:3.12.15-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-test-0:3.12.15-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-tkinter-0:3.12.15-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-tkinter-0:3.12.15-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +27 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes. Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped.

🔗 References (5)