[CLSA-2026:1791483627] alt-python27: Fix of CVE-2026-19445
Type:
security
Severity:
Critical
Release date:
2026-10-09 08:07:49 UTC
Description:
- CVE-2026-19445: use-after-free of a server-side SSLContext when the servername callback switches SSLSocket.context. _servername_callback now takes strong references to the socket's current context and its callback instead of a borrowed SSL_CTX servername arg, and context_dealloc unregisters the callback.
CVEs fixed:
Updated packages:
  • alt-python27-2.7.18-45.el8.x86_64.rpm
    sha:1065a8d816b62953885fe46aae71da378b4c8de585bec3666bf719c04b4277c6
  • alt-python27-debug-2.7.18-45.el8.x86_64.rpm
    sha:e85c4f23a01bbc3aaa924e5865f33f1564e75d50080e2498f8d8962d5f165ad7
  • alt-python27-devel-2.7.18-45.el8.x86_64.rpm
    sha:490b0086e76ed22e69b76b383c51d5d1bc63e2a38695a288201f84b614bbf90f
  • alt-python27-libs-2.7.18-45.el8.x86_64.rpm
    sha:118b712691ad529eefc4d4c66941a981b4dfbe74a3bc0134b110de04d670e5a0
  • alt-python27-test-2.7.18-45.el8.x86_64.rpm
    sha:efe769061b631f909987941c10f90c217be155c882ab01c1e76083a19cd291e4
  • alt-python27-tkinter-2.7.18-45.el8.x86_64.rpm
    sha:44ea0a3d70c80dae5171739deeee349bdd8029fed862e2145e05668c76208a1b
  • alt-python27-tools-2.7.18-45.el8.x86_64.rpm
    sha:79aabe79e531e915cea12447cc4ed262afe77758d44c0b40229a9656a652a913
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.