Bug 2563296

Summary:	python-httplib2: Distrust eMudhra intermediate CA certificates due to security concerns
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, aprice, asdas, cmyers, dnakabaa, dpaolell, dschmidt, eglynn, jdelft, jjoyce, jlanda, jpretori, jsamir, jschluet, jupierce, kaycoth, kshier, lcouzens, lgarciaa, lhh, mbiarnes, mburns, mgarciac, oezr, ppalepu, ppostler, prdhamdh, rbobbitt, rhel-process-autobot, rjohnson, sghai, sidsharm, simaishi, stcannon, suppawar, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	The certificate authority (CA) store used in Python httplib2 included root CA certificate of authority, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client applications using httplib2 and cause such applications to connect to malicious sites.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2563344
Bug Blocks:

Description OSIDB Bzimport 2026-10-29 09:51:01 UTC

Distrust eMudhra intermediate CA certificates due to security concerns in python-httplib2

https://emudhra.we-have-a-problem.com/

python-httplib2 version 0.32.1 removed the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates:

https://github.com/httplib2/httplib2/compare/v0.32.0...v0.32.1
https://github.com/httplib2/httplib2/pull/262
https://github.com/httplib2/httplib2/commit/5fee2b095f49a6ad5e1f0a185d909c89199e4dc9

Note that httplib2 uses certificate store from the Python certifi module, if the module is available, and only falls back to the customer version if certifi module is not available.

Comment 1 Tomas Hoger 2026-10-29 10:15:18 UTC

While python-httlib2 RPM packages in Fedora, EPEL, or Red Hat products such as RHEL include cacerts.txt file, the library is modified to not load that file and use system certificate bundle from the ca-certificates package instead.  Therefore, they are not affected by this issue.

https://src.fedoraproject.org/rpms/python-httplib2/blob/5000171539/f/python-httplib2.certfile.patch

Comment 3 errata-xmlrpc 2026-11-12 19:14:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.8 Extended Update Support

Via RHSA-2026:99693 https://access.redhat.com/errata/RHSA-2026:99693