Critical Security Update for Python 3.12: Addressing SSL Vulnerabilities
Summary
ALSA-2026:77020: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.15-1.el10_2. Fixed in 3.12.15-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and is equipped with extensive libraries and frameworks. The affected packages, including python-unversioned-command, python3, python3-debug, python3-devel, python3-idle, python3-libs, python3-test, and python3-tkinter, are essential components of the Python ecosystem in AlmaLinux 10. This security update addresses critical vulnerabilities that could compromise the integrity of SSL communications.
Vulnerability Detail
The vulnerabilities arise from a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), which can lead to man-in-the-middle attacks (CVE-2026-19553). Additionally, a use-after-free issue occurs when the sni_callback switches contexts, potentially allowing an attacker to exploit memory management flaws (CVE-2026-19445). These vulnerabilities can severely impact the security of applications relying on SSL/TLS for secure communications.
How To Fix
Minimum fixed version
3.12.15-1.el10_2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling SSL verification in your application if immediate patching is not feasible. However, this is not recommended for production environments due to security risks. Instead, prioritize updating to the patched version as soon as possible.
Conclusion
The security update for Python 3.12 addresses critical vulnerabilities that could compromise SSL communications. It is essential to update the affected packages to the latest version to protect your applications from potential attacks. Utilize tools like Vulert to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-unversioned-command →
FAQ
The update addresses a certificate verification bypass and a use-after-free vulnerability in SSLContext.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
These vulnerabilities can lead to man-in-the-middle attacks and memory exploitation, compromising application security.
Disabling SSL verification can be a temporary workaround, but it is not recommended for production systems.
Regularly check for updates and apply them promptly to ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
