https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 06:58:54 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19553 <p>ssl.SSLContext.wrap_bio() didn&#39;t require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn&#39;t supplied then hostname verification would be silently skipped.</p> <p>This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.</p> <p>If the program passes a server_hostname value that isn&#39;t an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.</p> <p>Mitigating this vulnerability doesn&#39;t require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn&#39;t supplied.</p> <p>ssl.SSLContext.wrap_bio() didn&#39;t require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn&#39;t supplied then hostname verification would be silently skipped.</p> <p>This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.</p> <p>If the program passes a server_hostname value that isn&#39;t an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.</p> <p>Mitigating this vulnerability doesn&#39;t require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn&#39;t supplied.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19553 https://vulnerability.circl.lu/vuln/ghsa-xx9w-qm94-hghj <p>ssl.SSLContext.wrap_bio() didn&#39;t require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn&#39;t supplied then hostname verification would be silently skipped.</p> <p>This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.</p> <p>If the program passes a server_hostname value that isn&#39;t an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.</p> <p>Mitigating this vulnerability doesn&#39;t require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn&#39;t supplied.</p> <p>ssl.SSLContext.wrap_bio() didn&#39;t require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn&#39;t supplied then hostname verification would be silently skipped.</p> <p>This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.</p> <p>If the program passes a server_hostname value that isn&#39;t an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability.</p> <p>Mitigating this vulnerability doesn&#39;t require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn&#39;t supplied.</p> https://vulnerability.circl.lu/vuln/ghsa-xx9w-qm94-hghj