Release date:
2026-10-27 08:38:46 UTC
Description:
- CVE-2026-115557: reject TLS chains that use one of the compromised eMudhra
intermediate CA keys. Backport of upstream gh-160040 / PR 160042, which
shipped only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2; 3.10 is EOL
upstream and got no release with it. Adds Modules/_ssl/distrusted_spki.h
(verbatim from upstream) with the SHA-256 digests of the eight distrusted
SubjectPublicKeyInfo structures, and an _ssl verify callback that fails the
chain with X509_V_ERR_CERT_REJECTED when a certificate matches. Matching on
the public key also covers cross-signed certificates that reuse one of the
keys
Updated packages:
-
alt-python310-3.10.22-3.el8.x86_64.rpm
sha:28c818052fe4d09a174e8aeb629a22d7e2cc51326c8c1459c4c7f366f62a887e
-
alt-python310-debug-3.10.22-3.el8.x86_64.rpm
sha:9ecfd95ff5c4a9df1fca8b711784cc34e26d7c914afc91c2f8d15c9ef7c98ad8
-
alt-python310-devel-3.10.22-3.el8.x86_64.rpm
sha:59e65311459a09e497c70ab3f66b0243e04933ceb3d823c4802b5fcaa7875c3e
-
alt-python310-idle-3.10.22-3.el8.x86_64.rpm
sha:a96060e58976fca2396e0a58cbbab4c0a35f4e26d1f2d41ba52d38cca2ff1a66
-
alt-python310-libs-3.10.22-3.el8.x86_64.rpm
sha:7d9fe0f01001cfed72f232782741e57eb7d0adb58529a9554412c5f027442567
-
alt-python310-test-3.10.22-3.el8.x86_64.rpm
sha:2fcf1675814635aa29ff66e6c90a9f7402a3330f8040de55ee93362b90cc253b
-
alt-python310-tkinter-3.10.22-3.el8.x86_64.rpm
sha:657ab02a305f8292701645919e1d8d4c142c5d24f6d81a15ba9a6ae6a4072db3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
