Skip to content
fr Sign in
7.2 High

CVE-2026-27459 pyOpenSSL is a Python wrapper around the OpenSSL library

Description

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
RHUI 4 for RHEL 8 Versions not published
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.5 1777403872 earliest → < 1777403872 1777403872
Show the 33 other branches
Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2.6 1777390333 earliest → < 1777390333 1777390333
Red Hat Hardened Images Versions not published
Red Hat Quay 3.12 1776752646 earliest → < 1776752646 1776752646
Red Hat Quay 3.14 1779689392 earliest → < 1779689392 1779689392
Red Hat Quay 3.15 1780891395 earliest → < 1780891395 1780891395
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.17 1779922205 earliest → < 1779922205 1779922205
Red Hat Quay 3.1 1776736910 earliest → < 1776736910 1776736910
Red Hat Quay 3.9 1776782369 earliest → < 1776782369 1776782369
Red Hat Trusted Artifact Signer 1.4 1775815407 earliest → < 1775815407 1775815407
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ansible Automation Platform Ansible Core 2 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Satellite 6 Versions not published
pyopenssl 22.0 22.0.0 → < 26.0.0 26.0.0
Red Hat Quay 3.10 1776736910 earliest → < 1776736910 1776736910
Red Hat Quay 3.18 1784987273 earliest → < 1784987273 1784987273
Confidential Compute Attestation Versions not published
Exploit Intelligence Versions not published
Lightspeed Core Versions not published
Red Hat Ceph Storage 7 Versions not published
Red Hat Ceph Storage 8 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Update Infrastructure 4 for Cloud Providers Versions not published
Red Hat Update Infrastructure 5 Versions not published
Red Hat Ansible Automation Platform 2.7 1787217531 earliest → < 1787217531 1787217531

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8

The 100 CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8 →
CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process 6.6 Medium CVE-2026-84720 Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle 6.5 Medium CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust 4.3 Medium CVE-2026-84717 Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates 5.3 Medium
Track this CVE