Release date:
2026-10-19 20:53:46 UTC
Description:
* SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback
- debian/patches/CVE-2026-19445.patch: take the SSLContext from the
connection and hold references to it and to the callback while the
callback runs, instead of using the borrowed pointer registered with
OpenSSL, and unregister the callback when the context is deallocated,
in Modules/_ssl.c, so a servername callback that switches the
connection to another context can no longer make the server call
through a freed SSLContext.
- CVE-2026-19445
Updated packages:
-
idle-python3.5_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_all.deb
sha:32d36f6663badcf1a08aceb834ce088ca1612018
-
libpython3.5_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:4f6b0a67154ececc9055cac14df0abc47c5a323c
-
libpython3.5-dev_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:37bdd10f2975cabfb75f00f3b61ed995e0a2a174
-
libpython3.5-minimal_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:2b897967febbf1fabe264ea716cd3d28cfe439ba
-
libpython3.5-stdlib_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:aaefbba2849bef4dace82fc37299e70301e2347b
-
libpython3.5-testsuite_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_all.deb
sha:8e9bd910dd814fbae95fd5954ffd2162ce5fd6ff
-
python3.5_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:1eb9a70498877f4acdbc46e7db9e767150153c11
-
python3.5-dev_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:72b860381356e1a86f385b253ccd81b2190f6b26
-
python3.5-doc_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_all.deb
sha:66e5e8df8ea0e1006811dc5e4ba6c527eaecee3e
-
python3.5-examples_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_all.deb
sha:1d02b4ff10c85ec40b5b35d4008fbcc2878af7df
-
python3.5-minimal_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:2d3230dd557947f5f94a15114ace26f8dd940602
-
python3.5-venv_3.5.2-2ubuntu0~16.04.13+tuxcare.els31_amd64.deb
sha:4d12808e799c7233067f22d593cdbb58a1cf6165
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
