AZL-112913: CVE-2026-19552 affecting package python-py 1.11.0-1

Q: What conditions are required for exploitation?

An application must call ssl.get_server_certificate() with the ca_certs parameter supplied. Under that condition, the certificate's identity is not checked.

Q: What is the practical security impact for affected applications?

Applications that rely on ssl.get_server_certificate() with ca_certs may accept a certificate without verifying that its identity matches the intended server. This can undermine the application's expected certificate identity validation.

Published Nov 9, 2026

Updated

When cacerts parameter was supplied to ssl.getservercertificate() function, the identity of the certificate is not checked.

Affected Software

1 affected component

azure-linux/python-py<=1.11.0-1

Event History

Nov 9, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-19552

Frequently Asked Questions

What conditions are required for exploitation?

An application must call ssl.get_server_certificate() with the ca_certs parameter supplied. Under that condition, the certificate's identity is not checked.

What is the practical security impact for affected applications?

Applications that rely on ssl.get_server_certificate() with ca_certs may accept a certificate without verifying that its identity matches the intended server. This can undermine the application's expected certificate identity validation.

AZL-112913: CVE-2026-19552 affecting package python-py 1.11.0-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical security impact for affected applications?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical security impact for affected applications?