GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.14] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) by gpshead · Pull Request #160569 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Oct 24, 2026

Copy link
Copy Markdown
Member

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes [email protected]

Manual backport notes (3.14): Makefile.pre.in and PCbuild/_ssl.vcxproj{,.filters} conflicted only because main also lists Modules/_openssl_mem.h (gh-156228, main-only). Resolved by adding just Modules/_ssl/distrusted_spki.h; the filters file also gains the Header Files filter definition (same GUID as main) since 3.14 had no headers listed. All other files are identical to the main commit. test_ssl, test_asyncio.test_ssl and test_asyncio.test_sslproto pass, including test_distrusted_spki.

  • Issue: ssl: distrust compromised eMudhra intermediate CA keys #160040

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran @gpshead
[3.14] pythongh-160040: Distrust compromised eMudhra intermediate CA …
d1c320f 
…keys (CVE-2026-115557) (pythonGH-160042)

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

---------

Signed-off-by: Christian Heimes <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-app bedevere-app Bot mentioned this pull request Oct 24, 2026
ssl: distrust compromised eMudhra intermediate CA keys #160040
Closed
@bedevere-app bedevere-app Bot added the type-security A security issue label Oct 24, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Oct 24, 2026
gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) #160042
Merged
@gpshead
gpshead marked this pull request as ready for review October 24, 2026 07:11
@gpshead
gpshead requested review from a team, erlend-aasland and picnixz as code owners October 24, 2026 07:11
@bedevere-app bedevere-app Bot added the awaiting core review label Oct 24, 2026
@gpshead gpshead added the release-blocker label Oct 24, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Oct 24, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Oct 24, 2026
@gpshead
gpshead merged commit e9bf2cf into python:3.14 Oct 24, 2026
55 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-project-automation github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Oct 24, 2026
@bedevere-app bedevere-app Bot removed the awaiting core review label Oct 24, 2026
@fhaze fhaze mentioned this pull request Oct 30, 2026
Backport Python TLS and tarfile security fixes for Windows packages fhaze/kitsu#323
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixz picnixz Awaiting requested review from picnixz picnixz is a code owner
@erlend-aasland erlend-aasland Awaiting requested review from erlend-aasland erlend-aasland is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@gpshead @tiran
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.