CVE-2026-19552ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity

Descripción

When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/python/cpython/pull/161507 patch
• https://github.com/python/cpython/issues/161503 issue-tracking
• https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/ vendor-advisory
• https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e patch
• http://www.openwall.com/lists/oss-security/2026/11/09/25