<div class="container">
<h1>Security update for python-M2Crypto</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:24710-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-11-11T16:23:31Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1275165">bsc#1275165</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1285047">bsc#1285047</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-0672.html">CVE-2026-0672</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-109087.html">CVE-2026-109087</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0672</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0672</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-0672</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-109087</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-109087</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves two vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for python-M2Crypto fixes the following issues:</p>
<p>Security issues fixed:</p>
<ul>
<li>CVE-2026-109087: SSL.Checker subjectAltName hostname injection (bsc#1285047).</li>
</ul>
<p>Non security issue fixed:</p>
<ul>
<li>swig 4.5.0 breaks python-M2Crypto (bsc#1275165).</li>
</ul>
<p>Changes for python-M2Crypto:</p>
<ul>
<li>update to 0.51.0:</li>
<li>CVE-2026-109087: SSL.Checker subjectAltName hostname
injection
(bsc#1285047, https://codefloe.com/mcepl/m2crypto/issues/409)</li>
<li>Fix regex injection in TLS hostname verification (no CVE,
kindly reported by eGkritsis)</li>
<li>adding the project to the Anthropic OSS Security Scanner
(https://github.com/anthropics/oss-scanner/pull/479)</li>
<li>update to 0.50.0:</li>
<li>switch to Codefloe</li>
<li>isolate OpenSSL providers in private contexts</li>
<li>disable legacy ENGINE bindings with OpenSSL 3 deprecations</li>
<li>manage BIO ownership when attaching to SSL connections</li>
<li>repair Windows CI pipeline and improve setup.py robustness</li>
<li>record security-related behavior changes</li>
<li>emit DeprecationWarning when RC4 cipher is instantiated</li>
<li>disable TLSv1.0 and TLSv1.1 by default</li>
<li>prevent out-of-bounds read in BN conversions</li>
<li>preserve errno from gettimeofday failures</li>
<li>restore timed read retries</li>
<li>Update to 0.49.0:</li>
<li>defer unavailable ENGINE constant lookup</li>
<li>fixes problematic behaviour of pkcs11-provider</li>
<li>support TLS 1.0 contexts with modern OpenSSL</li>
<li>use Python 3 C APIs in handwritten SWIG code (bsc#1275165)</li>
<li>feat: Add AES-GCM (AEAD) support to M2Crypto</li>
<li>remove Black configuration from setup.cfg</li>
<li>release X509V3 config with its context</li>
<li>keep IOBuffer chains alive until destruction</li>
<li>test: free low-level OpenSSL objects in leak tests</li>
<li>avoid leaking X509V3 extension config</li>
<li>free RSA exponent on modulus conversion failure</li>
<li>free replaced EVP digest contexts</li>
<li>wrap created X509 name entries with ownership</li>
<li>own ASN1 values created from Python data</li>
<li>own PKCS7 certificate stack copies</li>
<li>release BIOs on explicit close</li>
<li>Add AuthorityKeyIdentifier extension support</li>
<li>Upgrade to 0.48.0:</li>
<li>doc: another move ... this time to Codeberg (and communication
to Matrix)</li>
<li>test(smime): parametrize test_write_pkcs7_der</li>
<li>test(smime): fix test_signEncryptDecryptVerify</li>
<li>fix(util): return bytes from passphrase callbacks</li>
<li>fix(SSL.Checker): add IDN Chinese name</li>
<li>test(ssl): add IDN certificate fixture coverage</li>
<li>test(ssl): cover IDN hostname matching in Checker</li>
<li>doc: update expected Name format in migration guide</li>
<li>fix(smime): S/MIME signature verification for Outlook and
Thunderbird</li>
<li>fix(provider): handle OSSL_STORE_INFO_PUBKEY compat. for
OpenSSL < 3.2</li>
<li>fix: cast X509_dup in sk_X509_deep_copy to avoid type
mismatch</li>
<li>fix(smime): remove obsolete Python pre-3.6 constructs</li>
<li>ci: run on Codeberg with forgejo_runner</li>
<li>doc: clarify the status of the project</li>
<li>fix(provider): adjust the CI run on Gitea for the older
OpenSSL on Debian</li>
<li>fix(evp): narrow digest and BIO pointers for mypy</li>
<li>fix(init): acommodate modern packaging API</li>
<li>doc: IRC channel is on Libera, Ergo was a wrong idea</li>
<li>fix(tests): remove duplicate definition of IS_DEBIAN in
test_ssl</li>
<li>fix(test_bio_ssl): fix TLS 1.3 deadlock and add socket
timeouts</li>
<li>fix(test_bio_ssl): replace sys.exit() with self.fail() to
prevent test process crash</li>
<li>ci: publish to PyPI with Sigstore attestations via Trusted
Publishing</li>
<li>fix(authcookie): handle CookieError from Python 3.13.12+
(CVE-2026-0672)</li>
<li>ci(leap): use setup.py bdist_wheel to bypass old pip PEP 517
wrapper</li>
<li>fix(util): replace is_32bit with struct.calcsize and update
tests</li>
<li>ci: add FreeBSD SourceHut CI build script</li>
<li>fix(swig): avoid clang GNUC pragma block before _lib.h</li>
<li>fix(provider): don't abuse TemporaryDirectory to be mkdtemp,
use that directly.</li>
<li>fix(provider): gate provider APIs for OpenSSL 1.1.1</li>
<li>feat(provider): add key generation and destruction methods</li>
<li>docs(provider): add comprehensive documentation to Provider
module</li>
<li>fix(provider): better exception handling</li>
<li>doc: add a simple AGENTS.md</li>
<li>feat(engine): add availability check, lifecycle helpers, and
safer cleanup</li>
<li>doc(engine): Improve documentation and example of using
Engine module</li>
<li>Upgrade to 0.47.0:</li>
<li>feat: added full SWIG bindings for the ASN1_UTCTIME</li>
<li>refactor(SWIG): adopt Python Buffer Protocol for
X509_NAME_ENTRY_set_data</li>
<li>fix: allow 64-bit time_t on 32-bit systems in test_is32bit</li>
<li>feat(provider): add initial OpenSSL providers support</li>
<li>feat: stop supporting 32bit packages on Windows</li>
<li>fix: improve detection of OpenSSL on Windows</li>
<li>ci: run doctest</li>
<li>fix: _matchIPAddress is failing</li>
<li>feat: Add degenerate PKCS7 (.p7c) support</li>
<li>fix(setup): add <code>packaging</code> as a requirement</li>
<li>feat(asn1): introduce dedicated ASN1_UTCTIME class</li>
<li>refactor(x509): CRL handling and testing</li>
<li>feat: add function to provide the equivalent of <code>openssl
ciphers</code>.</li>
<li>fix(X509): refactor new_extension to prevent memory
corruption</li>
<li>ci: add tests showing the use of M2Crypto for STARTTLS
protocol</li>
<li>doc: convert documentation to MyST</li>
<li>doc: various improvements of documentation</li>
<li>revert: remove support for Engine</li>
<li>fix(engine): make the compilation of Engine conditional on
OPENSSL_NO_ENGINE</li>
<li>fix(https): make HTTPS Connection work with Proxy</li>
<li>doc: add an example of using HTTPS with PKCS#11 Engine</li>
<li>Update to 0.46.2:</li>
<li>fix[m2xmlrpclib]: make the module compatible with Python 3.6</li>
<li>Update to 0.46.1:</li>
<li>M2Crypto closes SSL connection on closing HTTPS Connection,
and some other related issues (#203, #278)</li>
<li>Modernize C API by eliminating use of deprecated
PyBytes_AsStringAndSize and related functions with Python
Buffer Protocol (#375)</li>
<li>Whole project is completely covered with type hints and is
checked by mypy (also while doing that, the whole project was
blackened) (#344)</li>
<li>Add logging support to C extension code sending messages to
the Python logging</li>
<li>Introducing first efforts to support Engine object (#229)</li>
<li>Reworked and fixed M2Crypto.m2xmlrpclib module (#163)</li>
<li>Reverted removal of demo/ subdirectory</li>
<li>Improve SMIME documentation (#377)</li>
<li>Some other minor bugs, improvements, and removal of dead code</li>
<li>Correct license to BSD-2-Clause and update references</li>
<li>Specify in setup.cfg that we require Python >= 3.6</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.0
<br/>
<code>zypper in -t patch SUSE-SLE-Micro-6.0-961</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.0 (aarch64 s390x x86_64)
<ul>
<li>python-M2Crypto-debugsource-0.51.0-159998.1.1</li>
<li>python311-M2Crypto-0.51.0-159998.1.1</li>
<li>python311-M2Crypto-debuginfo-0.51.0-159998.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-0672.html">https://www.suse.com/security/cve/CVE-2026-0672.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-109087.html">https://www.suse.com/security/cve/CVE-2026-109087.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1275165">https://bugzilla.suse.com/show_bug.cgi?id=1275165</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1285047">https://bugzilla.suse.com/show_bug.cgi?id=1285047</a>
</li>
</ul>
</div>