Release date:
2026-10-27 08:40:47 UTC
Description:
- CVE-2026-115557: reject TLS chains that use one of the compromised eMudhra
intermediate CA keys. Backport of upstream gh-160040 / PR 160042, which
shipped only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2; 3.10 is EOL
upstream and got no release with it. Adds Modules/_ssl/distrusted_spki.h
(verbatim from upstream) with the SHA-256 digests of the eight distrusted
SubjectPublicKeyInfo structures, and an _ssl verify callback that fails the
chain with X509_V_ERR_CERT_REJECTED when a certificate matches. Matching on
the public key also covers cross-signed certificates that reuse one of the
keys
Updated packages:
-
alt-python310-3.10.22-3.el9.x86_64.rpm
sha:c1f25cf161c892850fc68c7678ef5ec1b1f6d21190096ca9f743814fa8ffcc42
-
alt-python310-debug-3.10.22-3.el9.x86_64.rpm
sha:ff55d3de923e8b1effa0331d521698c1b3ef943ba09dee24b18c97b78b513cbb
-
alt-python310-devel-3.10.22-3.el9.x86_64.rpm
sha:ead571e0bd03672057a26ec3e31644f9c98f16039de0ca9a6b9dfffd762ab98c
-
alt-python310-idle-3.10.22-3.el9.x86_64.rpm
sha:980ef26591e52f507ef7e9c144d7c494eb72dece9269122f40410162ab934124
-
alt-python310-libs-3.10.22-3.el9.x86_64.rpm
sha:b220f4a06665edfb9dc6c83eef5858add47ec3224be4737762308a293d90b24e
-
alt-python310-test-3.10.22-3.el9.x86_64.rpm
sha:2ddf699ed6d448078e951c921da4893742d8a9b26cdb682dfda212a624090993
-
alt-python310-tkinter-3.10.22-3.el9.x86_64.rpm
sha:86b822aa071f066ea26bec17561b8a048d07e4e21c26547625ed5a8510e68db9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
