python3.11-pyOpenSSL-24.2.1-1.el9 at Foreman/Katello 3.14/4.16

Support
1

Problem: python3.11-pyOpenSSL-24.2.1-1.el9.noarch is vulnerable.

Hello,
I’d like to ask the same question, and particularly about package: python3.11-pyOpenSSL-24.2.1-1.el9.noarch.

I’ve noticed that after migration to Foreman/Katello 3.14/4.16 python3.12 was installed.
So I assume that python3.11 can be removed, at least most of its packages are marked for removal by ‘dnf autoremove’. But python3.11-pyOpenSSL-24.2.1-1.el9.noarch is not one of those, marked for removal.

Is python3.11-pyOpenSSL-24.2.1-1.el9.noarch still required for Foreman/Katello 3.14/4.16 or can it be removed.
Thank you.

Expected outcome:

Foreman and Proxy versions: 3.14

Foreman and Proxy plugin versions: Foreman/Katello 3.14/4.16

Distribution and version:

Other relevant data: Red Hat 9

2

You can run autoremove to clean up. Possibly there may be some remaining because foreman-installer did not remove them during upgrade and/or some may have been directly installed by foreman-installer, thus dependencies won’t work.

I have just checked: I have removed

python3.11-bracex.noarch
python3.11-protobuf.x86_64
python3.11-pyOpenSSL.noarch
python3.11-pyflakes.noarch
python3.11-pyjwt.noarch
python3.11-ruamel-yaml.noarch
python3.11-ruamel-yaml-clib.x86_64
python3.11-tenacity.noarch
python3.11-wcmatch.noarch
python3.11-pycairo.x86_64
python3.11-pygobject.x86_64
python3.11-solv.x86_64

in December after updating to 3.16.

If you check them you should see that they came from foreman/katello/pulpcore repositories. I think they should also be listed with

# dnf list --extras

as there is no repository which provides them.

Thus it should be safe to remove them.

3

Hello and thank you for your answer.
Here’s my python3.11* packages for autoremove:

python3.11-bracex
python3.11-colorama
python3.11-commonmark
python3.11-contextlib2
python3.11-daemon
python3.11-dataclasses
python3.11-docutils
python3.11-ecdsa
python3.11-enrich
python3.11-future
python3.11-lockfile
python3.11-pexpect
python3.11-ptyprocess
python3.11-pycryptodomex
python3.11-pyjwkest
python3.11-rich
python3.11-ruamel-yaml
python3.11-ruamel-yaml-clib
python3.11-tenacity
python3.11-types-cryptography
python3.11-wcmatch

Also i noticed that:
python3.11-pulpcore-0:3.63.11-1.el9.noarch
python3.11-requests-0:2.32.3-2.el9.noarch
require it. And they’re not marked for autoremove either.

So, autoremove doesn’t include: python3.11-pyOpenSSL-24.2.1-1.el9.noarch which was installed from “pulpcore” repository.
Hence my question about it.

Thank you so much.

4

Why do you keep asking about the specific python3.11-pyOpenSSL package?

I can only repeat: run autoremove first to clean up the obvious.

And I can only repeat to check for extras. Those are packages which are not available from any repository. dnf list --extras shows you the packages with the repositories where they originally came from thus it should be easy to identify what can go. Not everything goes with autoremove as not everything has been installed via simple dependency.

And I have already gave you a list of packages which I have removed from my server.

5

I keep asking about python3.11-pyOpenSSL-24.2.1-1.el9
because it’s vulnerable: (CVE-2026-27459) and should be remediated by upgrade or removal.

Many thanks for your answers gvde.

6

It would be helpful if you would give this piece of information right from the start.

As mentioned: you can remove the package and all those other.

Of course, if you are so concerned about security in an obsolete, unused installed package you should rather quickly upgrade to the latest supported foreman/katello versions 3.18/4.20 or 3.19/4.21.

Support for your version has ended September 2025 thus the list of bugs and potential security issues in the version you are actually running may be much longer and more important than that CVE.