Skip to content
OpenAdvisories
High ELSA-2026-89742 3 CVEs

Important: python3.9 security update (Oracle Linux 9)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Oracle Linux

Summary

[3.9.25-7.0.1.el9_8.6]
- Remove upstream URL reference

[3.9.25-7.6]
- CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
Resolves: RHEL-274143

[3.9.25-7.5]
- CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext when sni_callback switches contexts
Resolves: RHEL-276263

[3.9.25-7.4]
- CVE-2026-12345 python3.9: python: Arbitrary file deletion via race condition during temporary directory cleanup
Resolves: RHEL-272937

[3.9.25-7.3]
- Security fix for CVE-2026-11940
Resolves: RHEL-227228

[3.9.25-7.2]
- Security fix for CVE-2026-15308
Resolves: RHEL-193786

[3.9.25-7.1]
- Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
Resolves: RHEL-194207

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 9 python-unversioned-command 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3-debug 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3-devel 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3-idle 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3-libs 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3-test 0:3.9.25-7.0.1.el9_8.6
Oracle Linux · 9 python3-tkinter 0:3.9.25-7.0.1.el9_8.6

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-19445 Public exploit

    Use-after-free of a server-side SSLContext when sni_callback switches contexts

    A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  • High 7.6
    CVE-2026-19553 Public exploit

    SSLContext.wrap_bio() missing validation of server_hostname parameter

    ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-12345 Public exploit

    Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

    The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi