Critical Security Flaws in Python3: Arbitrary File Deletion and SSL Vulnerabilities
Summary
RLSA-2026:85239: Important: python3 security update. Affects python3 versions < 0:3.6.8-79.el8_10.rocky.0. Fixed in 0:3.6.8-79.el8_10.rocky.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and is equipped with extensive libraries and frameworks, making it a popular choice for developers. However, recent vulnerabilities have exposed Python3 to significant security risks, particularly in its handling of SSL contexts and temporary file management.
Vulnerability Detail
The vulnerabilities identified in Python3 include an arbitrary file deletion issue due to a race condition during temporary directory cleanup, which can lead to unauthorized file access or deletion. Additionally, there is a certificate verification bypass caused by missing server_hostname validation in SSLContext.wrap_bio(), allowing attackers to exploit SSL connections. Lastly, a use-after-free vulnerability occurs when the sni_callback switches contexts, potentially leading to memory corruption and further exploitation.
How To Fix
Minimum fixed version
0:3.6.8-79.el8_10.rocky.0
This is the first release that contains the fix.
sudo dnf update python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling SSL verification in your application if it is safe to do so, although this is not recommended for production environments. You can disable SSL verification by setting 'verify=False' in your requests, like this: 'requests.get(url, verify=False)'. However, be aware that this exposes your application to potential security risks.
Conclusion
In summary, the recent vulnerabilities in Python3 present significant security risks that require immediate attention. Updating to the latest patched version is crucial to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3 →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
These vulnerabilities can lead to unauthorized file access, data loss, and exploitation of SSL connections, which can compromise the security of applications relying on Python3.
Yes, the arbitrary file deletion vulnerability poses a risk of data loss as it allows unauthorized deletion of files within the temporary directory.
If an immediate update is not possible, consider implementing workarounds such as disabling SSL verification temporarily, but be cautious as this can expose your application to security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
