Release date:
2026-10-19 17:48:22 UTC
Description:
* SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback
(CVE-2026-19445)
- debian/patches/CVE-2026-19445.patch: look the SSLContext up from
the SSL object instead of the borrowed pointer registered with
OpenSSL, hold references to it and to the callback while it runs,
and unregister the callback when the SSLContext is deallocated in
Modules/_ssl.c, so that a later ClientHello can no longer reach a
released SSLContext; add a regression test to Lib/test/test_ssl.py
and a note to Doc/library/ssl.rst
- CVE-2026-19445
Updated packages:
-
idle-python2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_all.deb
sha:6f46905550fe74cb20a5aaf2cdf22b500c66e132
-
libpython2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:44c134406229d2cfc5fca27c46b55962282603ee
-
libpython2.7-dev_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:bbf96a53381e1e3f492d19cf6019acd600a7c1e5
-
libpython2.7-minimal_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:cbabf314aaae2517bf90b7be4f5e5f823184ed7e
-
libpython2.7-stdlib_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:9eefc4896db5b0207fdd33b830db601937ea55ca
-
libpython2.7-testsuite_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_all.deb
sha:6136d01b0b575287b1b3ec1a7f9122d15df5333b
-
python2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:cf19b86f602dc1c50e8075433c38c07bb3a47bea
-
python2.7-dev_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:326d16a7d1f915f0b643dde0a6bee6198c88194d
-
python2.7-doc_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_all.deb
sha:d3de8acfbfdaca0731ac82659cbefee8af3b8ac1
-
python2.7-examples_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_all.deb
sha:b34881a76b6f65ad202fd851e2a11fb60f301f23
-
python2.7-minimal_2.7.17-1~18.04ubuntu1.11+tuxcare.els19_amd64.deb
sha:bb620244d0baebc65c6302fc432fe179e8e532de
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
