Description
When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.16.0a2 | 3.16.0a2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python3.14 +1 | No fix yet | — |
| Debian 13 | python3.13 | No fix yet | — |
| Debian 12 | python3.11 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python3.14 | No fix yet | — |
| Ubuntu 26.04 LTS | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | No fix yet | — |
| Ubuntu 22.04 LTS | python3.10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python3 +1 | No fix yet | — |
References
- https://github.com/python/cpython/pull/161507 patch
- https://github.com/python/cpython/issues/161503 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/ vendor-advisory
- https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e patch