Critical Security Flaws in Python3 Packages: Important Update Required
Summary
ALSA-2026:85239: Important: python3 security update. Affects platform-python versions < 3.6.8-79.el8_10.alma.1. Fixed in 3.6.8-79.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and is equipped with a rich set of libraries and frameworks. The impacted packages, including platform-python, python3-libs, and others, are essential components in the AlmaLinux ecosystem, providing core functionalities for Python development and execution. Recent vulnerabilities have been identified that could compromise the security of applications relying on these packages.
Vulnerability Detail
The vulnerabilities stem from multiple security flaws in Python, including an arbitrary file deletion issue due to a race condition during temporary directory cleanup, a certificate verification bypass caused by missing server_hostname validation in SSLContext.wrap_bio(), and a use-after-free vulnerability of a server-side SSLContext when the sni_callback switches contexts. These vulnerabilities could lead to unauthorized access, data loss, or exploitation of the affected systems.
How To Fix
Minimum fixed version
3.6.8-79.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functionalities until the packages are updated. However, it is highly recommended to apply the updates as soon as possible to mitigate the risks associated with these vulnerabilities.
Conclusion
In summary, critical vulnerabilities have been identified in several Python3 packages used in the AlmaLinux ecosystem. It is crucial to update these packages to the latest patched version to ensure the security and integrity of applications. Users are encouraged to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for platform-python →
FAQ
The main vulnerabilities include arbitrary file deletion, certificate verification bypass, and use-after-free issues in SSLContext.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
The recommended action is to update the affected Python packages to the patched version 3.6.8-79.el8_10.alma.1 as soon as possible.
Failing to update the affected packages may expose your applications to security risks, including unauthorized access and data loss.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
