Critical Security Update for Python 3.12: Certificate Verification Bypass and Use-After-Free Vulnerabilities
Summary
ALSA-2026:77017: Important: python3.12 security update. Affects python3.12 versions < 3.12.15-1.el9_8. Fixed in 3.12.15-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features modules, classes, exceptions, and high-level dynamic data types, making it a versatile choice for developers. However, recent security vulnerabilities have been identified that could compromise the integrity of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), which could allow attackers to intercept and manipulate SSL connections. Additionally, a use-after-free vulnerability occurs when the sni_callback switches contexts, potentially leading to memory corruption and exploitation. These vulnerabilities can have severe implications, including unauthorized access to sensitive data and disruption of service.
How To Fix
Minimum fixed version
3.12.15-1.el9_8
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable SSL verification in their applications, but this is not recommended due to the security risks it introduces. Instead, it is advisable to apply the patch as soon as possible.
Conclusion
The identified vulnerabilities in Python 3.12 pose significant security risks that can affect applications relying on this version. It is crucial for users to update to the latest patched version to safeguard their systems against potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include a certificate verification bypass and a use-after-free issue in SSLContext.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
It is recommended to update Python 3.12 to version 3.12.15-1.el9_8 to mitigate the vulnerabilities.
Not updating could lead to potential exploitation of the vulnerabilities, resulting in unauthorized access and data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
