Summary
[3.12.15-1.0.1]
- Remove upstream URL reference
[3.12.15-1]
- Update to 3.12.15
- Security fix for CVE-2026-15310
- Security fix for CVE-2026-15806
- Security fix for CVE-2026-17084
- Security fix for CVE-2026-19445
- Security fix for CVE-2026-19553
- Security fix for CVE-2026-19672
- Security fix for CVE-2026-82049
- Security fix for CVE-2026-87910
Resolves: RHEL-274127
Resolves: RHEL-276240
[3.12.14-1]
- Update to Python 3.12.14
Resolves: RHEL-227203
[3.12.13-2.1]
- Security fix for CVE-2026-15308
Resolves: RHEL-193771
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | python-unversioned-command | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3 | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3-debug | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3-devel | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3-idle | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3-libs | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3-test | 0:3.12.15-1.0.1.el10_2 |
| Oracle Linux · 10 | python3-tkinter | 0:3.12.15-1.0.1.el10_2 |
Vulnerabilities 2
-
Critical 9.2CVE-2026-19445 Public exploit
Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …
-
High 7.6CVE-2026-19553 Public exploit
SSLContext.wrap_bio() missing validation of server_hostname parameter
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…