Critical Security Flaw in Python 3.12: Certificate Verification Bypass and Use-After-Free Vulnerability
Summary
RLSA-2026:77020: Important: python3.12 security update. Affects python3.12 versions < 0:3.12.15-1.el10_2. Fixed in 0:3.12.15-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications, including web development, data analysis, artificial intelligence, and more. This version of Python has been found to have critical security vulnerabilities that could potentially allow attackers to bypass certificate verification and exploit memory management issues.
Vulnerability Detail
The vulnerabilities identified in Python 3.12 include a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), which can lead to man-in-the-middle attacks. Additionally, a use-after-free vulnerability occurs when the sni_callback switches contexts, potentially allowing an attacker to execute arbitrary code. These vulnerabilities pose significant risks, especially in applications that rely on secure communications.
How To Fix
Minimum fixed version
0:3.12.15-1.el10_2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable SSL certificate verification in your application, but this is not recommended for production environments due to security risks. If you must implement this, you can modify your SSL context as follows: 'ssl_context.verify_mode = ssl.CERT_NONE'. However, this should only be a short-term measure until the package is updated.
Conclusion
In summary, Python 3.12 has critical vulnerabilities that require immediate attention. Updating to the patched version is essential to mitigate risks associated with certificate verification bypass and use-after-free issues. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to intercept secure communications and execute arbitrary code, leading to data breaches and system compromises.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, consider implementing the temporary workaround of disabling SSL verification, but be aware of the associated risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
