Skip to content
OpenAdvisories
Critical RHSA-2026:85239 3 CVEs

Red Hat Security Advisory: python3 security update

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 14

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream platform-python 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream platform-python-debug 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream platform-python-devel 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-debuginfo 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-debugsource 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-idle 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-test 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-tkinter 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos platform-python 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-debuginfo 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-debugsource 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-libs 0:3.6.8-79.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-test 0:3.6.8-79.el8_10

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-19445 Public exploit

    Use-after-free of a server-side SSLContext when sni_callback switches contexts

    A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  • High 7.6
    CVE-2026-19553 Public exploit

    SSLContext.wrap_bio() missing validation of server_hostname parameter

    ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-12345 Public exploit

    Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

    The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543492
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544138
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85239.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-12345
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-12345
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-12345
  • article
    https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d
  • article
    https://github.com/python/cpython/issues/157579
  • article
    https://github.com/python/cpython/pull/157580
  • report
    https://access.redhat.com/security/cve/CVE-2026-19445
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19445
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19445
  • article
    https://github.com/python/cpython/issues/156293
  • article
    https://github.com/python/cpython/pull/158504
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/
  • report
    https://access.redhat.com/security/cve/CVE-2026-19553
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19553
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19553
  • article
    https://github.com/python/cpython/issues/156793
  • article
    https://github.com/python/cpython/pull/158503
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/