[CLSA-2026:1791468473] alt-python27: Fix of CVE-2026-19445
Type:
security
Severity:
Critical
Release date:
2026-10-09 06:26:25 UTC
Description:
- CVE-2026-19445: use-after-free of a server-side SSLContext when the servername callback switches SSLSocket.context. _servername_callback now takes strong references to the socket's current context and its callback instead of a borrowed SSL_CTX servername arg, and context_dealloc unregisters the callback.
CVEs fixed:
Updated packages:
  • alt-python27-2.7.18-45.el7.x86_64.rpm
    sha:935d115f2b43929ebc620c8803b956158e6d20dbfc6e259e64c736ead2634e51
  • alt-python27-debug-2.7.18-45.el7.x86_64.rpm
    sha:b88e29dec3af7a510d265a70c2ad34dffc7823b70399468cef2c6e28b6d7db46
  • alt-python27-devel-2.7.18-45.el7.x86_64.rpm
    sha:a4864a46479a852e9114057f19f6b18554e283d627daa57f3ba1f41cfda00373
  • alt-python27-libs-2.7.18-45.el7.x86_64.rpm
    sha:4661874af764fc9af59c8106d7c9f7eb4298c5225407fdf3c807d8beca8ccab2
  • alt-python27-test-2.7.18-45.el7.x86_64.rpm
    sha:b2c3befcd90ccc1f5115cef2b49d2634fa6945d9e3e99120959b583fe230f0a7
  • alt-python27-tkinter-2.7.18-45.el7.x86_64.rpm
    sha:c5dfa25314bf9de8007589cbb573ea256599a015c60e309e710b3773385b14a0
  • alt-python27-tools-2.7.18-45.el7.x86_64.rpm
    sha:3c9746a7b87686cd44bc2289ab49d23e392835de501516a4bae5c5677fb56f5a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.