Release date:
2026-10-27 08:43:02 UTC
Description:
- CVE-2026-115557: reject TLS chains that use one of the compromised eMudhra
intermediate CA keys. Backport of upstream gh-160040 / PR 160042, which
shipped only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2; 3.10 is EOL
upstream and got no release with it. Adds Modules/_ssl/distrusted_spki.h
(verbatim from upstream) with the SHA-256 digests of the eight distrusted
SubjectPublicKeyInfo structures, and an _ssl verify callback that fails the
chain with X509_V_ERR_CERT_REJECTED when a certificate matches. Matching on
the public key also covers cross-signed certificates that reuse one of the
keys
Updated packages:
-
alt-python310-3.10.22-3.el10.x86_64.rpm
sha:f57e5e37adc9ed1a05292a7b205c45066e5695b2c1c52a14b613d155ab3958ff
-
alt-python310-debug-3.10.22-3.el10.x86_64.rpm
sha:735d1fd4dcbaa6df584ced1987826928badc6ce22294d58db83e046c772e0c34
-
alt-python310-devel-3.10.22-3.el10.x86_64.rpm
sha:2aa5113722a848aac10bf863a53f1bff49a43fd04454368e5b6e899fd8c4eb11
-
alt-python310-idle-3.10.22-3.el10.x86_64.rpm
sha:2b9aaf12b9603dfde8f8661641b6f1566de67ae924895968ce19ebec02e1c82c
-
alt-python310-libs-3.10.22-3.el10.x86_64.rpm
sha:1ed937a46e6cf6999927808b5f2739ebce9af15d13f8bea02a6c5fff1bcc6d7f
-
alt-python310-test-3.10.22-3.el10.x86_64.rpm
sha:7e26a32649c8c645f5da902f0457e4b475f6675b320c4c808cb4e9dc1ebfa0ce
-
alt-python310-tkinter-3.10.22-3.el10.x86_64.rpm
sha:508fbcbd697b67ba2bd75be732ddc2539acd06004adfdee89604fd9ef6681202
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
