Release date:
2026-10-27 11:19:22 UTC
Description:
- CVE-2026-115557: reject TLS chains that use one of the compromised eMudhra
intermediate CA keys. Backport of upstream gh-160040 / PR 160042, which
shipped only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2; 3.10 is EOL
upstream and got no release with it. Adds Modules/_ssl/distrusted_spki.h
(verbatim from upstream) with the SHA-256 digests of the eight distrusted
SubjectPublicKeyInfo structures, and an _ssl verify callback that fails the
chain with X509_V_ERR_CERT_REJECTED when a certificate matches. Matching on
the public key also covers cross-signed certificates that reuse one of the
keys
Updated packages:
-
alt-python310-3.10.22-3.el7.x86_64.rpm
sha:675780434edc1e6064fe5a412ec20fd735f5b006127ef3b8eb4edfd048967bc4
-
alt-python310-debug-3.10.22-3.el7.x86_64.rpm
sha:b6e8cb5fb63099806467a33f46e2bf6d1a3d6bb2e3f1cb2cd6a949e530fa2486
-
alt-python310-devel-3.10.22-3.el7.x86_64.rpm
sha:daf68da70e42be8b7f8608f00d3a016e428ae64d6cbbd494ba07d87a8d49f755
-
alt-python310-idle-3.10.22-3.el7.x86_64.rpm
sha:f61f23ac400891b695982ff9ce99d6da3adbbfc82218fd83d3c8bfd4297e186f
-
alt-python310-libs-3.10.22-3.el7.x86_64.rpm
sha:2bec35142ad1b10ddc49f7c2ef6bb2e247ecfdc48c9df5744d3de792caf1e65b
-
alt-python310-test-3.10.22-3.el7.x86_64.rpm
sha:25527f4c2112f06ccfd1c975295e4808522e65f0b3f4eb276689418fbdb8a765
-
alt-python310-tkinter-3.10.22-3.el7.x86_64.rpm
sha:00a422b77fed04732033bee45c5b9cfd0b44363b502eb710f8c96378b6166e04
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
