Summary
[3.6.8-79.0.1]
- Add Oracle Linux distribution in platform.py [Orabug: 20812544]
[3.6.8.openela.0]
- Add openela to supported dists
[3.6.8-79]
- Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553
Resolves: RHEL-272935, RHEL-276260, RHEL-274107
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | platform-python | 0:3.6.8-79.0.1.el8_10 |
| Oracle Linux · 8 | platform-python-debug | 0:3.6.8-79.0.1.el8_10 |
| Oracle Linux · 8 | platform-python-devel | 0:3.6.8-79.0.1.el8_10 |
| Oracle Linux · 8 | python3-idle | 0:3.6.8-79.0.1.el8_10 |
| Oracle Linux · 8 | python3-libs | 0:3.6.8-79.0.1.el8_10 |
| Oracle Linux · 8 | python3-test | 0:3.6.8-79.0.1.el8_10 |
| Oracle Linux · 8 | python3-tkinter | 0:3.6.8-79.0.1.el8_10 |
Vulnerabilities 3
-
Critical 9.2CVE-2026-19445 Public exploit
Use-after-free of a server-side SSLContext when sni_callback switches contexts
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …
-
High 7.6CVE-2026-19553 Public exploit
SSLContext.wrap_bio() missing validation of server_hostname parameter
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…
-
Medium 5.9CVE-2026-12345 Public exploit
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…