Skip to content
OpenAdvisories
High ELSA-2026-58952 1 CVE

Important: python-urwid security update (Oracle Linux 9)

Published Aug 24, 2026 · Updated Aug 24, 2026

Ecosystem: Oracle Linux

Summary

[2.1.2-4.1]
- Fix CVE-2026-9323: use cryptographically secure session identifiers
in web display module
- Resolves: RHEL-212564

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 python3-urwid 0:2.1.2-4.el9_8.1

Vulnerabilities 1

  • High 8.1
    CVE-2026-9323

    Insecure PRNG and Information Exposure in urwid Web Display Backend

    The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call co…

    urwid urwid python-urwid urwid Debian Ubuntu Azure Linux