UBUNTU-CVE-2026-119170: High severity ubuntu/python2.7 vulnerability
Published Nov 9, 2026
·Updated
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
Affected Software
17 affected components
ubuntu/python2.7*
ubuntu/python3.4*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.6*
ubuntu/python3.7*
ubuntu/python3.8*
ubuntu/python2.7*
ubuntu/python3.9*
ubuntu/python3.10*
ubuntu/python2.7*
ubuntu/python3.11*
ubuntu/python3.12*
ubuntu/python3.14*
ubuntu/python3.14*
Event History
Nov 9, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are actually affected?
Only deployments using Python 3.14.10 with OpenSSL operating in FIPS mode are affected. Other Python versions are unaffected.
2
Does a default Python installation face this issue?
The issue requires OpenSSL to be in FIPS mode. Deployments not using OpenSSL FIPS mode are not affected.
3
What security property is impacted?
The regression affects enforcement of FIPS-approved algorithms in the hashlib module. The provided severity vector indicates network-reachable exploitation without privileges or user interaction, with impact to integrity.