Fix CVE(s): CVE-2026-19445, CVE-2026-19553
* SECURITY UPDATE: hostname verification silently skipped by SSLContext.wrap_bio() when no server_hostname is given - debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the wrap_bio() arguments like wrap_socket() does: reject server_hostname and session in server mode, and emit a DeprecationWarning when check_hostname is enabled but server_hostname is None, so a client that verified the certificate chain but never the peer's identity is no longer silent about it (asyncio's create_connection()/start_tls() reach this path too). Backport of upstream commit 5867d4e4ae6d (gh-156793 / GH-158503, 3.10 branch, which warns instead of raising ValueError for backward compatibility). Bundles the upstream regression tests (test_ssl.py, test_sslproto.py), adapted to the 3.7 test.support API. - CVE-2026-19553 * SECURITY UPDATE: use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, look the SSLContext up from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to it and to the callback while they are used, and unregister the callback when the context is deallocated, so a TLS client can no longer make a server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream commit ec44b5a3258c (gh-156293 / GH-158504, 3.10 branch); Py_NewRef() is replaced by Py_INCREF() for 3.7. Bundles the upstream regression tests (test_ssl.py), adapt
- Products
- idle-python3.7, libpython3.7, libpython3.7-dev, libpython3.7-minimal, libpython3.7-stdlib, libpython3.7-testsuite, python3.7, python3.7-dev, python3.7-doc, python3.7-examples, python3.7-minimal, python3.7-venv
- Affected versions
- Not specified
- Fixed versions
- 3.7.3-2+deb10u7+tuxcare.els9
- CVEs
- CVE-2026-19445, CVE-2026-19553
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:23 UTC · Revision 1
Source evidence
* SECURITY UPDATE: hostname verification silently skipped by SSLContext.wrap_bio() when no server_hostname is given - debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the wrap_bio() arguments like wrap_socket() does: reject server_hostname and session in server mode, and emit a DeprecationWarning when check_hostname is enabled but server_hostname is None, so a client that verified the certificate chain but never the peer's identity is no longer silent about it (asyncio's create_connection()/start_tls() reach this path too). Backport of upstream commit 5867d4e4ae6d (gh-156793 / GH-158503, 3.10 branch, which warns instead of raising ValueError for backward compatibility). Bundles the upstream regression tests (test_ssl.py, test_sslproto.py), adapted to the 3.7 test.support API. - CVE-2026-19553 * SECURITY UPDATE: use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, look the SSLContext up from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to it and to the callback while they are used, and unregister the callback when the context is deallocated, so a TLS client can no longer make a server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream commit ec44b5a3258c (gh-156293 / GH-158504, 3.10 branch); Py_NewRef() is replaced by Py_INCREF() for 3.7. Bundles the upstream regression tests (test_ssl.py), adapt
osv:CLSA-2026-1791535989
idle-python3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
libpython3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
libpython3.7-dev
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
libpython3.7-minimal
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
libpython3.7-stdlib
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
libpython3.7-testsuite
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
python3.7
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
python3.7-dev
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
python3.7-doc
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
python3.7-examples
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
python3.7-minimal
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
python3.7-venv
Fixed versions: 3.7.3-2+deb10u7+tuxcare.els9
Complete source record
{
"id": "12dc43c3cf4bcdc2779370e502c4c2ab31e0026804ddad646c6e4b87ed50d130",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791535989",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2026-19445, CVE-2026-19553",
"summary": "* SECURITY UPDATE: hostname verification silently skipped by SSLContext.wrap_bio() when no server_hostname is given - debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the wrap_bio() arguments like wrap_socket() does: reject server_hostname and session in server mode, and emit a DeprecationWarning when check_hostname is enabled but server_hostname is None, so a client that verified the certificate chain but never the peer's identity is no longer silent about it (asyncio's create_connection()/start_tls() reach this path too). Backport of upstream commit 5867d4e4ae6d (gh-156793 / GH-158503, 3.10 branch, which warns instead of raising ValueError for backward compatibility). Bundles the upstream regression tests (test_ssl.py, test_sslproto.py), adapted to the 3.7 test.support API. - CVE-2026-19553 * SECURITY UPDATE: use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, look the SSLContext up from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to it and to the callback while they are used, and unregister the callback when the context is deallocated, so a TLS client can no longer make a server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream commit ec44b5a3258c (gh-156293 / GH-158504, 3.10 branch); Py_NewRef() is replaced by Py_INCREF() for 3.7. Bundles the upstream regression tests (test_ssl.py), adapt",
"evidence": "osv:CLSA-2026-1791535989",
"products": [
{
"name": {
"value": "idle-python3.7",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-dev",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-minimal",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-stdlib",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpython3.7-testsuite",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-dev",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-doc",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-examples",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-minimal",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3.7-venv",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.3-2+deb10u7+tuxcare.els9",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791535989",
"aliases": [
"CLSA-2026-1791535989"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "idle-python3.7",
"purl": "pkg:deb/tuxcare/idle-python3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "libpython3.7",
"purl": "pkg:deb/tuxcare/libpython3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "libpython3.7-dev",
"purl": "pkg:deb/tuxcare/libpython3.7-dev?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "libpython3.7-minimal",
"purl": "pkg:deb/tuxcare/libpython3.7-minimal?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "libpython3.7-stdlib",
"purl": "pkg:deb/tuxcare/libpython3.7-stdlib?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "libpython3.7-testsuite",
"purl": "pkg:deb/tuxcare/libpython3.7-testsuite?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "python3.7",
"purl": "pkg:deb/tuxcare/python3.7?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "python3.7-dev",
"purl": "pkg:deb/tuxcare/python3.7-dev?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "python3.7-doc",
"purl": "pkg:deb/tuxcare/python3.7-doc?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "python3.7-examples",
"purl": "pkg:deb/tuxcare/python3.7-examples?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "python3.7-minimal",
"purl": "pkg:deb/tuxcare/python3.7-minimal?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.3-2+deb10u7+tuxcare.els9"
}
]
}
],
"package": {
"name": "python3.7-venv",
"purl": "pkg:deb/tuxcare/python3.7-venv?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791535989.json"
}
}
],
"modified": "2026-10-26T09:31:53.387817198Z",
"provider": "osv",
"upstream": [
"CVE-2026-19445",
"CVE-2026-19553"
],
"references": [
"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1791535989.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19445",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19553"
]
},
"related_cves": [
{
"value": "CVE-2026-19445",
"evidence": "/upstream"
},
{
"value": "CVE-2026-19553",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448849,
"published_at": "2026-10-09T08:53:22+00:00"
}