{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: ssl accepted TLS certificate chains signed by the\n compromised eMudhra intermediate CAs. Their keys were compromised and\n revoked, but a chain issued by one of those intermediates keeps\n verifying until the platform root store (OS image, container image, or\n a CA bundle shipped inside a Python package) drops the issuing roots,\n so an attacker able to obtain such a certificate could impersonate any\n host to an ssl client.\n - debian/patches/CVE-2026-115557.patch: backport of cpython\n 7dd8b4736a1419750b94a388e6d158be15836fe6 (gh-160040, GH-160042).\n _ssl now carries the SHA-256 digests of the eight compromised\n intermediates' SubjectPublicKeyInfo and rejects, from an OpenSSL\n verify callback, any chain containing a certificate whose SPKI digest\n is on the list, reporting X509_V_ERR_CERT_REJECTED. Matching the\n public key rather than a certificate fingerprint also covers the\n cross-signed certificates that reuse one of those keys. Upstream\n shipped this in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2 only,\n so 3.6 needs it carried. The denylist header is placed at\n Modules/_ssl_distrusted_spki.h because 3.6 has no Modules/_ssl/\n directory, the callback is installed at both of 3.6's\n SSL_CTX_set_verify() call sites (_set_verify_mode() and\n set_post_handshake_auth()), and the new header is declared through\n setup.py, which builds the _ssl extension in 3.6. Upstream's\n newPySSLSocket() hunk has no counterpart: 3.6 has no SSL_set_verify()\n call. The upstream tests, test certificate fixture, NEWS fragment and\n PCbuild changes are not carried.\n - CVE-2026-115557", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1793092311", "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1793092311" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/debian10/advisories/2026/clsa-2026_1793092311.json" } ], "tracking": { "current_release_date": "2026-10-28T15:34:21Z", "generator": { "date": "2026-10-28T15:34:21Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793092311", "initial_release_date": "2026-10-27T09:11:53Z", "revision_history": [ { "date": "2026-10-27T09:11:53Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-28T15:34:21Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Fix CVE(s): CVE-2026-115557" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 10", "product": { "name": "Debian 10", "product_id": "Debian-10", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-python36-test-0:3.6.15-51.amd64", "product": { "name": "alt-python36-test-0:3.6.15-51.amd64", "product_id": "alt-python36-test-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36-test@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } }, { "category": "product_version", "name": "alt-python36-tkinter-0:3.6.15-51.amd64", "product": { "name": "alt-python36-tkinter-0:3.6.15-51.amd64", "product_id": "alt-python36-tkinter-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36-tkinter@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } }, { "category": "product_version", "name": "alt-python36-libs-0:3.6.15-51.amd64", "product": { "name": "alt-python36-libs-0:3.6.15-51.amd64", "product_id": "alt-python36-libs-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36-libs@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } }, { "category": "product_version", "name": "alt-python36-debug-0:3.6.15-51.amd64", "product": { "name": "alt-python36-debug-0:3.6.15-51.amd64", "product_id": "alt-python36-debug-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36-debug@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } }, { "category": "product_version", "name": "alt-python36-0:3.6.15-51.amd64", "product": { "name": "alt-python36-0:3.6.15-51.amd64", "product_id": "alt-python36-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } }, { "category": "product_version", "name": "alt-python36-devel-0:3.6.15-51.amd64", "product": { "name": "alt-python36-devel-0:3.6.15-51.amd64", "product_id": "alt-python36-devel-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36-devel@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } }, { "category": "product_version", "name": "alt-python36-tools-0:3.6.15-51.amd64", "product": { "name": "alt-python36-tools-0:3.6.15-51.amd64", "product_id": "alt-python36-tools-0:3.6.15-51.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python36-tools@3.6.15-51?arch=amd64&os_name=debian&os_version=10" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-python36-test-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-test-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-test-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python36-tkinter-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-tkinter-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-tkinter-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python36-libs-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-libs-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-libs-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python36-debug-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-debug-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-debug-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python36-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python36-devel-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-devel-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-devel-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python36-tools-0:3.6.15-51.amd64 as a component of Debian 10", "product_id": "Debian-10:alt-python36-tools-0:3.6.15-51.amd64" }, "product_reference": "alt-python36-tools-0:3.6.15-51.amd64", "relates_to_product_reference": "Debian-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-115557", "cwe": { "id": "CWE-299", "name": "Improper Check for Certificate Revocation" }, "notes": [ { "category": "description", "text": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:alt-python36-0:3.6.15-51.amd64", "Debian-10:alt-python36-debug-0:3.6.15-51.amd64", "Debian-10:alt-python36-devel-0:3.6.15-51.amd64", "Debian-10:alt-python36-libs-0:3.6.15-51.amd64", "Debian-10:alt-python36-test-0:3.6.15-51.amd64", "Debian-10:alt-python36-tkinter-0:3.6.15-51.amd64", "Debian-10:alt-python36-tools-0:3.6.15-51.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-115557" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/20/29", "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29" }, { "category": "external", "summary": "https://emudhra.we-have-a-problem.com/", "url": "https://emudhra.we-have-a-problem.com/" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d", "url": "https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd", "url": "https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93", "url": "https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6", "url": "https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5", "url": "https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b", "url": "https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90", "url": "https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8", "url": "https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78", "url": "https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370", "url": "https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e", "url": "https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3", "url": "https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/160040", "url": "https://github.com/python/cpython/issues/160040" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/160042", "url": "https://github.com/python/cpython/pull/160042" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/24/5", "url": "http://www.openwall.com/lists/oss-security/2026/10/24/5" } ], "release_date": "2026-10-24T15:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T09:11:53.938708Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1793092311", "product_ids": [ "Debian-10:alt-python36-0:3.6.15-51.amd64", "Debian-10:alt-python36-debug-0:3.6.15-51.amd64", "Debian-10:alt-python36-devel-0:3.6.15-51.amd64", "Debian-10:alt-python36-libs-0:3.6.15-51.amd64", "Debian-10:alt-python36-test-0:3.6.15-51.amd64", "Debian-10:alt-python36-tkinter-0:3.6.15-51.amd64", "Debian-10:alt-python36-tools-0:3.6.15-51.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1793092311" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }