UBUNTU-CVE-2026-19552: Medium severity ubuntu/python2.7 vulnerability
Published Nov 12, 2026
·Updated
When cacerts parameter was supplied to ssl.getservercertificate() function, the identity of the certificate is not checked.
Affected Software
17 affected components
ubuntu/python2.7*
ubuntu/python3.4*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.6*
ubuntu/python3.7*
ubuntu/python3.8*
ubuntu/python2.7*
ubuntu/python3.9*
ubuntu/python3.10*
ubuntu/python2.7*
ubuntu/python3.11*
ubuntu/python3.12*
ubuntu/python3.14*
ubuntu/python3.14*
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
When is an application affected?
An application is affected when it calls ssl.get_server_certificate() with the ca_certs parameter supplied. In that case, the certificate's identity is not checked.
2
Does providing ca_certs ensure the certificate belongs to the intended server?
No. The available information states that supplying ca_certs does not cause ssl.get_server_certificate() to verify the certificate identity.
3
Which Ubuntu Python packages are listed as affected?
The affected software list includes Ubuntu packages for Python 2.7 and Python 3.4 through 3.9, as well as Python 3.14.