Red Hat Security Advisory

RHSA-2026:77020

python3.12 security update

Released 2026-10-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.15-1.el10_2, python3-devel-3.12.15-1.el10_2, python3-tkinter-3.12.15-1.el10_2
Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.15-1.el10_2, python3-libs-3.12.15-1.el10_2, python3.12-3.12.15-1.el10_2
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.15-1.el10_2, python3-idle-3.12.15-1.el10_2, python3-test-3.12.15-1.el10_2

Fixes 2 records

TI-2026-15850 CVE-2026-19445 · GHSA-7jvw-f348-84gq

Use-after-free of a server-side SSLContext when sni_callback switches contexts

MEDIUM 40

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server nam…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00524 Published 2026-09-30 Partial fix · 3.10.22, 3.11.17 +4 CWE-416

TI-2026-15902 CVE-2026-19553 · GHSA-xx9w-qm94-hghj

SSLContext.wrap_bio() missing validation of server_hostname parameter

LOW 36

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00547 Published 2026-09-30 Partial fix · 3.10.22, 3.11.17 +4 CWE-297