Critical Security Flaw in Python 3.12: Certificate Verification Bypass and Use-After-Free Vulnerabilities
Summary
RLSA-2026:77017: Important: python3.12 security update. Affects python3.12 versions < 0:3.12.15-1.el9_8. Fixed in 0:3.12.15-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications due to its simplicity and versatility. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this version, particularly in SSL/TLS communications.
Vulnerability Detail
The vulnerabilities in Python 3.12 include a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), which could allow attackers to intercept and manipulate secure communications. Additionally, a use-after-free vulnerability occurs when the sni_callback switches contexts, potentially leading to memory corruption and exploitation. These vulnerabilities could allow unauthorized access to sensitive data and compromise the integrity of applications using this version of Python.
How To Fix
Minimum fixed version
0:3.12.15-1.el9_8
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling SSL verification in your application, though this is not recommended for production environments due to security risks. You can do this by modifying your SSL context settings, but be aware that this exposes your application to potential attacks.
Conclusion
The vulnerabilities in Python 3.12 pose significant security risks that could affect applications relying on this version. It is crucial to update to the latest patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include a certificate verification bypass and a use-after-free issue in SSLContext, which can lead to security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of the vulnerabilities in Python 3.12 is 8.1, indicating a high level of severity.
Yes, a patch is available in version 3.12.15-1.el9_8 of Python 3.12. It is recommended to update to this version.
If immediate updating is not possible, consider implementing temporary workarounds, such as disabling SSL verification, but be cautious as this can expose your application to risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
