[CLSA-2026:1791467021] alt-python27: Fix of CVE-2026-19445
Type:
security
Severity:
Critical
Release date:
2026-10-08 13:43:52 UTC
Description:
- CVE-2026-19445: use-after-free of a server-side SSLContext when the servername callback switches SSLSocket.context. _servername_callback now takes strong references to the socket's current context and its callback instead of a borrowed SSL_CTX servername arg, and context_dealloc unregisters the callback.
CVEs fixed:
Updated packages:
  • alt-python27-2.7.18-45.el10.x86_64.rpm
    sha:57bcd1d74464f82ff468ab0e3073dd30c980c6e0d6b4150cca39b37f1835a549
  • alt-python27-debug-2.7.18-45.el10.x86_64.rpm
    sha:a94d782ff7cdd7777d63fdd39e7195404830fb401a1494e6811d8718e4f09690
  • alt-python27-devel-2.7.18-45.el10.x86_64.rpm
    sha:f131b6012b0f688fcc7824b55d28156ba48fe670df78a869f288b4f5469648be
  • alt-python27-libs-2.7.18-45.el10.x86_64.rpm
    sha:387085620f500d8188c16c2393187feb590c5595f3b2dbf1d9605143a765bce9
  • alt-python27-test-2.7.18-45.el10.x86_64.rpm
    sha:e7531df3a1dce4b26f4a8e1776d565bfa9685c36eeac0d3b0fd8df2a6c9b748f
  • alt-python27-tkinter-2.7.18-45.el10.x86_64.rpm
    sha:4f7dd537ae6580d277fca43e0f6d088a832d2ab1f165b7893646931bbdb8a8df
  • alt-python27-tools-2.7.18-45.el10.x86_64.rpm
    sha:de46c1b0d988ce74c4ec710f3dbeb790cd9fa5b7d7e966a5b00db8a9ae91780a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.