OESA-2026-4589: python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):
ssl.SSLContext.wrapbio() didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification appeared to be succeeding with SSLContext.checkhostname = True and no ValueError being raised due to misconfiguration.
If the program passes a serverhostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.
Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty serverhostname value to SSLContext.wrapbio(), asyncio.createconnection(), or asyncio.loop.starttls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrapsocket(), when serverhostname isn't supplied.(CVE-2026-19553)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python3to a version that resolves this vulnerability.Fixed in 3.11.6-44.oe2403sp1 - Configuration
Pass a valid non-None and non-empty server_hostname to ssl.SSLContext.wrap_bio(), SSLContext.wrap_socket(), asyncio.create_connection(), and asyncio.loop.start_tls() when SSLContext.check_hostname is enabled.
Python SSL/TLS APIs server_hostname = valid, non-None, and non-empty string
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using ssl.SSLContext.wrap_bio() or SSLObject with SSLContext.check_hostname enabled are exposed only when they omit server_hostname or pass None. Applications that pass a non-empty server_hostname value perform hostname verification as expected.
Does enabling SSLContext.check_hostname alone ensure hostname validation?
No. In the affected behavior, hostname validation can be silently skipped when server_hostname is not supplied, despite check_hostname being set to True and no ValueError being raised.
What is required for exploitation?
An attacker would need to interact with a program that establishes TLS connections using the affected API pattern without a server_hostname value. User interaction is required according to the supplied severity vector.
What can be done until the security update is applied?
Ensure every affected TLS API call supplies a non-empty server_hostname value. This causes certificate hostname verification to proceed as expected.