Release date:
2026-10-19 20:55:08 UTC
Description:
* SECURITY UPDATE: use-after-free in the ssl module when a servername
callback switches the connection to another SSLContext
- debian/patches/CVE-2026-19445.patch: look the SSLContext up from the
SSL object instead of the borrowed servername-callback argument and
hold references to it and to the callback while they are used, and
unregister the callback when the context is deallocated, in
Modules/_ssl.c, so a TLS client can no longer make the server call
through a freed SSLContext; adds the upstream regression tests to
Lib/test/test_ssl.py.
- CVE-2026-19445
Updated packages:
-
idle-python3.6_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_all.deb
sha:8b22f6031257610a546701b57eb021e2736566d4
-
libpython3.6_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:ead857917b196badc5477182cc068a04daeb4ecb
-
libpython3.6-dev_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:41e9990a17d26e38c5508cfd82612cb7033eec4f
-
libpython3.6-minimal_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:ea92d38a0181e7da500a4da683106ac9e2fc30bc
-
libpython3.6-stdlib_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:adafd205f2a814434fe7891b3030f79fc7422e27
-
libpython3.6-testsuite_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_all.deb
sha:54063b92e71d9211df1f5f213844ffdfe819f94b
-
python3.6_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:5d3e4064c30f67a4bf6cc813047268185198f3e7
-
python3.6-dev_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:0445afd88d36db0040d730cef2ab5eb1d32dd7a2
-
python3.6-doc_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_all.deb
sha:569f90e5508259c7a4c7e6f7619e6210ae53ce99
-
python3.6-examples_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_all.deb
sha:33d53b2af44a92e7f0bac24394f53f6409565a3b
-
python3.6-minimal_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:2f507b6588b4e77cfed8372aecd6f0970769fa01
-
python3.6-venv_3.6.9-1~18.04ubuntu1.12+tuxcare.els27_amd64.deb
sha:f5e6e7a8122de02b0afa168715639979b25e8971
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
