GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.13] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) by gpshead · Pull Request #160570 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Oct 24, 2026

Copy link
Copy Markdown
Member

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes [email protected]

Manual backport notes (3.13): 3.13's Lib/test/certdata/make_ssl_certs.py predates the argparse cmdlineargs refactor, so make_distrusted_spki_cert() takes no arguments and uses the script's module-level enddate and the literal '7000' days that the rest of the 3.13 script uses (3.13's req_template has no {days} placeholder). Makefile.pre.in and PCbuild/_ssl.vcxproj{,.filters} add only Modules/_ssl/distrusted_spki.h (main's _openssl_mem.h is main-only), plus the Header Files filter definition. Modules/_ssl.c, Lib/test/test_ssl.py, the NEWS entry, distrusted_spki.h and distrusted.zip are identical to main. test_ssl, test_asyncio.test_ssl and test_asyncio.test_sslproto pass, including test_distrusted_spki.

  • Issue: ssl: distrust compromised eMudhra intermediate CA keys #160040

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran @gpshead
[3.13] pythongh-160040: Distrust compromised eMudhra intermediate CA …
74ebf8e 
…keys (CVE-2026-115557) (pythonGH-160042)

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

---------

Signed-off-by: Christian Heimes <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes <[email protected]>
This was referenced Oct 24, 2026
ssl: distrust compromised eMudhra intermediate CA keys #160040
Closed
gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) #160042
Merged
@bedevere-app bedevere-app Bot added the type-security A security issue label Oct 24, 2026
@gpshead gpshead closed this Oct 24, 2026
@gpshead gpshead reopened this Oct 24, 2026
@gpshead
gpshead marked this pull request as ready for review October 24, 2026 07:12
@gpshead
gpshead requested a review from a team as a code owner October 24, 2026 07:12
@bedevere-app bedevere-app Bot added the awaiting core review label Oct 24, 2026
@gpshead gpshead added the release-blocker label Oct 24, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Oct 24, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Oct 24, 2026
@gpshead gpshead assigned Yhg1s Oct 24, 2026
@Yhg1s
Yhg1s merged commit 98f0e4e into python:3.13 Oct 24, 2026
56 of 66 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Oct 24, 2026
@github-project-automation github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@Yhg1s Yhg1s

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@gpshead @Yhg1s @tiran
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.