Skip to content
OpenAdvisories
High ELSA-2026-58562 1 CVE

Important: python-urwid security update (Oracle Linux 8)

Published Aug 24, 2026 · Updated Aug 24, 2026

Ecosystem: Oracle Linux

Summary

[1.3.1-5]
- Use secure random session identifiers in web display (CVE-2026-9323)
- Resolves: RHEL-212562

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 python3-urwid 0:1.3.1-5.el8_10

Vulnerabilities 1

  • High 8.1
    CVE-2026-9323

    Insecure PRNG and Information Exposure in urwid Web Display Backend

    The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call co…

    urwid urwid python-urwid urwid Debian Ubuntu Azure Linux