SUSE-SU-2026:5177-1: Security update for python-M2Crypto

Q: Which deployments should prioritize this update?

Prioritize systems that use python-M2Crypto's SSL.Checker for hostname validation, because the fixed issue affects subjectAltName hostname handling. The advisory does not identify specific applications, configurations, or affected package versions.

Q: What mitigation is available if the update cannot be applied immediately?

No workaround or temporary mitigation is provided in the advisory. Review uses of SSL.Checker and apply the SUSE security update when possible.

Q: How can I determine whether a system is affected?

Check whether the system has the SUSE python-M2Crypto package installed and whether applications use SSL.Checker for certificate hostname validation. The provided information does not include fixed version numbers or detection indicators.

Published Nov 10, 2026

Updated

This update for python-M2Crypto fixes the following issue:

- CVE-2026-109087: SSL.Checker subjectAltName hostname injection (bsc#1285047).

Affected Software

2 affected componentsFixes available

suse/python-m2crypto<0.29.0-23.11.1

0.29.0-23.11.1

suse/python-m2crypto<0.29.0-23.11.1

0.29.0-23.11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/python-M2Crypto to a version that resolves this vulnerability.
Fixed in 0.29.0-23.11.1
Upgrade
Upgrade python-M2Crypto to a version that resolves this vulnerability.
Patch bsc#1285047

Event History

Nov 10, 2026

Advisory Published

via OSV·05:35 PM

Data Sourced

via OSV·05:35 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109087

Frequently Asked Questions

Which deployments should prioritize this update?

Prioritize systems that use python-M2Crypto's SSL.Checker for hostname validation, because the fixed issue affects subjectAltName hostname handling. The advisory does not identify specific applications, configurations, or affected package versions.

What mitigation is available if the update cannot be applied immediately?

No workaround or temporary mitigation is provided in the advisory. Review uses of SSL.Checker and apply the SUSE security update when possible.

How can I determine whether a system is affected?

Check whether the system has the SUSE python-M2Crypto package installed and whether applications use SSL.Checker for certificate hostname validation. The provided information does not include fixed version numbers or detection indicators.

SUSE-SU-2026:5177-1: Security update for python-M2Crypto

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should prioritize this update?

What mitigation is available if the update cannot be applied immediately?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should prioritize this update?

What mitigation is available if the update cannot be applied immediately?

How can I determine whether a system is affected?