SUSE-SU-2026:24710-1: important: Security update for python-M2Crypto
SLE-SECURITY-UPDATES
null at suse.de
Fri Nov 13 08:30:26 UTC 2026
# Security update for python-M2Crypto
Announcement ID: SUSE-SU-2026:24710-1
Release Date: 2026-11-11T16:23:31Z
Rating: important
References:
* bsc#1275165
* bsc#1285047
Cross-References:
* CVE-2026-0672
* CVE-2026-109087
CVSS scores:
* CVE-2026-0672 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-0672 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-0672 ( NVD ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-109087 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-109087 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:
* SUSE Linux Micro 6.0
An update that solves two vulnerabilities can now be installed.
## Description:
This update for python-M2Crypto fixes the following issues:
Security issues fixed:
* CVE-2026-109087: SSL.Checker subjectAltName hostname injection
(bsc#1285047).
Non security issue fixed:
* swig 4.5.0 breaks python-M2Crypto (bsc#1275165).
Changes for python-M2Crypto:
* update to 0.51.0:
* CVE-2026-109087: SSL.Checker subjectAltName hostname injection (bsc#1285047,
https://codefloe.com/mcepl/m2crypto/issues/409)
* Fix regex injection in TLS hostname verification (no CVE, kindly reported by
eGkritsis)
* adding the project to the Anthropic OSS Security Scanner
(https://github.com/anthropics/oss-scanner/pull/479)
* update to 0.50.0:
* switch to Codefloe
* isolate OpenSSL providers in private contexts
* disable legacy ENGINE bindings with OpenSSL 3 deprecations
* manage BIO ownership when attaching to SSL connections
* repair Windows CI pipeline and improve setup.py robustness
* record security-related behavior changes
* emit DeprecationWarning when RC4 cipher is instantiated
* disable TLSv1.0 and TLSv1.1 by default
* prevent out-of-bounds read in BN conversions
* preserve errno from gettimeofday failures
* restore timed read retries
* Update to 0.49.0:
* defer unavailable ENGINE constant lookup
* fixes problematic behaviour of pkcs11-provider
* support TLS 1.0 contexts with modern OpenSSL
* use Python 3 C APIs in handwritten SWIG code (bsc#1275165)
* feat: Add AES-GCM (AEAD) support to M2Crypto
* remove Black configuration from setup.cfg
* release X509V3 config with its context
* keep IOBuffer chains alive until destruction
* test: free low-level OpenSSL objects in leak tests
* avoid leaking X509V3 extension config
* free RSA exponent on modulus conversion failure
* free replaced EVP digest contexts
* wrap created X509 name entries with ownership
* own ASN1 values created from Python data
* own PKCS7 certificate stack copies
* release BIOs on explicit close
* Add AuthorityKeyIdentifier extension support
* Upgrade to 0.48.0:
* doc: another move ... this time to Codeberg (and communication to Matrix)
* test(smime): parametrize test_write_pkcs7_der
* test(smime): fix test_signEncryptDecryptVerify
* fix(util): return bytes from passphrase callbacks
* fix(SSL.Checker): add IDN Chinese name
* test(ssl): add IDN certificate fixture coverage
* test(ssl): cover IDN hostname matching in Checker
* doc: update expected Name format in migration guide
* fix(smime): S/MIME signature verification for Outlook and Thunderbird
* fix(provider): handle OSSL_STORE_INFO_PUBKEY compat. for OpenSSL < 3.2
* fix: cast X509_dup in sk_X509_deep_copy to avoid type mismatch
* fix(smime): remove obsolete Python pre-3.6 constructs
* ci: run on Codeberg with forgejo_runner
* doc: clarify the status of the project
* fix(provider): adjust the CI run on Gitea for the older OpenSSL on Debian
* fix(evp): narrow digest and BIO pointers for mypy
* fix(init): acommodate modern packaging API
* doc: IRC channel is on Libera, Ergo was a wrong idea
* fix(tests): remove duplicate definition of IS_DEBIAN in test_ssl
* fix(test_bio_ssl): fix TLS 1.3 deadlock and add socket timeouts
* fix(test_bio_ssl): replace sys.exit() with self.fail() to prevent test
process crash
* ci: publish to PyPI with Sigstore attestations via Trusted Publishing
* fix(authcookie): handle CookieError from Python 3.13.12+ (CVE-2026-0672)
* ci(leap): use setup.py bdist_wheel to bypass old pip PEP 517 wrapper
* fix(util): replace is_32bit with struct.calcsize and update tests
* ci: add FreeBSD SourceHut CI build script
* fix(swig): avoid clang GNUC pragma block before _lib.h
* fix(provider): don't abuse TemporaryDirectory to be mkdtemp, use that
directly.
* fix(provider): gate provider APIs for OpenSSL 1.1.1
* feat(provider): add key generation and destruction methods
* docs(provider): add comprehensive documentation to Provider module
* fix(provider): better exception handling
* doc: add a simple AGENTS.md
* feat(engine): add availability check, lifecycle helpers, and safer cleanup
* doc(engine): Improve documentation and example of using Engine module
* Upgrade to 0.47.0:
* feat: added full SWIG bindings for the ASN1_UTCTIME
* refactor(SWIG): adopt Python Buffer Protocol for X509_NAME_ENTRY_set_data
* fix: allow 64-bit time_t on 32-bit systems in test_is32bit
* feat(provider): add initial OpenSSL providers support
* feat: stop supporting 32bit packages on Windows
* fix: improve detection of OpenSSL on Windows
* ci: run doctest
* fix: _matchIPAddress is failing
* feat: Add degenerate PKCS7 (.p7c) support
* fix(setup): add `packaging` as a requirement
* feat(asn1): introduce dedicated ASN1_UTCTIME class
* refactor(x509): CRL handling and testing
* feat: add function to provide the equivalent of `openssl ciphers`.
* fix(X509): refactor new_extension to prevent memory corruption
* ci: add tests showing the use of M2Crypto for STARTTLS protocol
* doc: convert documentation to MyST
* doc: various improvements of documentation
* revert: remove support for Engine
* fix(engine): make the compilation of Engine conditional on OPENSSL_NO_ENGINE
* fix(https): make HTTPS Connection work with Proxy
* doc: add an example of using HTTPS with PKCS#11 Engine
* Update to 0.46.2:
* fix[m2xmlrpclib]: make the module compatible with Python 3.6
* Update to 0.46.1:
* M2Crypto closes SSL connection on closing HTTPS Connection, and some other
related issues (#203, #278)
* Modernize C API by eliminating use of deprecated PyBytes_AsStringAndSize and
related functions with Python Buffer Protocol (#375)
* Whole project is completely covered with type hints and is checked by mypy
(also while doing that, the whole project was blackened) (#344)
* Add logging support to C extension code sending messages to the Python
logging
* Introducing first efforts to support Engine object (#229)
* Reworked and fixed M2Crypto.m2xmlrpclib module (#163)
* Reverted removal of demo/ subdirectory
* Improve SMIME documentation (#377)
* Some other minor bugs, improvements, and removal of dead code
* Correct license to BSD-2-Clause and update references
* Specify in setup.cfg that we require Python >= 3.6
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.0
zypper in -t patch SUSE-SLE-Micro-6.0-961
## Package List:
* SUSE Linux Micro 6.0 (aarch64 s390x x86_64)
* python-M2Crypto-debugsource-0.51.0-159998.1.1
* python311-M2Crypto-0.51.0-159998.1.1
* python311-M2Crypto-debuginfo-0.51.0-159998.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-0672.html
* https://www.suse.com/security/cve/CVE-2026-109087.html
* https://bugzilla.suse.com/show_bug.cgi?id=1275165
* https://bugzilla.suse.com/show_bug.cgi?id=1285047
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261113/f7e59d84/attachment.htm>
More information about the sle-security-updates
mailing list