Skip to content
OpenAdvisories
High ELSA-2026-77017 2 CVEs

Important: python3.12 security update (Oracle Linux 9)

Published Oct 8, 2026 · Updated Oct 8, 2026

Ecosystem: Oracle Linux

Summary

[3.12.15-1.0.1]
- Remove upstream URL reference

[3.12.15-1]
- Update to 3.12.15
- Security fix for CVE-2026-15310
- Security fix for CVE-2026-15806
- Security fix for CVE-2026-17084
- Security fix for CVE-2026-19445
- Security fix for CVE-2026-19553
- Security fix for CVE-2026-19672
- Security fix for CVE-2026-82049
- Security fix for CVE-2026-87910
Resolves: RHEL-274140
Resolves: RHEL-276310

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 9 python3.12 0:3.12.15-1.0.1.el9_8
Oracle Linux · 9 python3.12-debug 0:3.12.15-1.0.1.el9_8
Oracle Linux · 9 python3.12-devel 0:3.12.15-1.0.1.el9_8
Oracle Linux · 9 python3.12-idle 0:3.12.15-1.0.1.el9_8
Oracle Linux · 9 python3.12-libs 0:3.12.15-1.0.1.el9_8
Oracle Linux · 9 python3.12-test 0:3.12.15-1.0.1.el9_8
Oracle Linux · 9 python3.12-tkinter 0:3.12.15-1.0.1.el9_8

Vulnerabilities 2

  • Critical 9.2
    CVE-2026-19445 Public exploit

    Use-after-free of a server-side SSLContext when sni_callback switches contexts

    A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  • High 7.6
    CVE-2026-19553 Public exploit

    SSLContext.wrap_bio() missing validation of server_hostname parameter

    ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine