{"id":"CLSA-2026-1791535989","summary":"Fix CVE(s): CVE-2026-19445, CVE-2026-19553","details":"   * SECURITY UPDATE: hostname verification silently skipped by\n     SSLContext.wrap_bio() when no server_hostname is given\n     - debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the\n       wrap_bio() arguments like wrap_socket() does: reject server_hostname\n       and session in server mode, and emit a DeprecationWarning when\n       check_hostname is enabled but server_hostname is None, so a client\n       that verified the certificate chain but never the peer's identity is\n       no longer silent about it (asyncio's create_connection()/start_tls()\n       reach this path too). Backport of upstream commit 5867d4e4ae6d\n       (gh-156793 / GH-158503, 3.10 branch, which warns instead of raising\n       ValueError for backward compatibility). Bundles the upstream\n       regression tests (test_ssl.py, test_sslproto.py), adapted to the 3.7\n       test.support API.\n     - CVE-2026-19553\n   * SECURITY UPDATE: use-after-free in the SSL servername (SNI) callback\n     - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, look the\n       SSLContext up from the connection instead of the borrowed pointer\n       registered with OpenSSL, hold strong references to it and to the\n       callback while they are used, and unregister the callback when the\n       context is deallocated, so a TLS client can no longer make a server\n       call through a freed SSLContext after sni_callback switched the\n       connection to another context. Backport of upstream commit\n       ec44b5a3258c (gh-156293 / GH-158504, 3.10 branch); Py_NewRef() is\n       replaced by Py_INCREF() for 3.7. Bundles the upstream regression\n       tests (test_ssl.py), adapted to the 3.7 test.support API.\n     - CVE-2026-19445","modified":"2026-10-26T09:31:53.387817198Z","published":"2026-10-09T08:53:22Z","upstream":["CVE-2026-19445","CVE-2026-19553"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1791535989.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553"}],"affected":[{"package":{"name":"idle-python3.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/idle-python3.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"libpython3.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"libpython3.7-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"libpython3.7-minimal","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-minimal?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"libpython3.7-stdlib","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-stdlib?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"libpython3.7-testsuite","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-testsuite?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"python3.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"python3.7-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"python3.7-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"python3.7-examples","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-examples?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"python3.7-minimal","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-minimal?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}},{"package":{"name":"python3.7-venv","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-venv?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"}}],"schema_version":"1.9.0"}