Bug 2563310

Summary:	python-botocore: Distrust eMudhra intermediate CA certificates due to security concerns
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, asegurap, bbrownin, blitton, cahl, cmyers, dfreiber, dnakabaa, doconnor, dpaolell, drow, dschmidt, dtrifiro, ebourniv, eglynn, ehelms, ggainey, hasun, ilpinto, jburrell, jdelft, jdobes, jfula, jholecek, jjoyce, jlanda, jmitchel, jowilson, jpasqual, jpretori, jsamir, jschluet, jupierce, juwatts, kaycoth, kgaikwad, kshier, lblicha, lcouzens, lgarciaa, lhh, ljawale, ltomasbo, mbarnett, mbiarnes, mburns, mdellweg, mgarciac, mhayden, mhulan, msilmser, mwoodson, nmoumoul, nyancey, oezr, ogajduse, ometelka, orabin, osousa, pakotvan, pcreech, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rchan, rhel-process-autobot, rjohnson, sbunciak, sdoran, sghai, sidsharm, simaishi, smallamp, stcannon, sthirugn, suppawar, syedriko, tmalecek, vkumar, vlaad, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan, zhunting, zzhou
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	The certificate authority (CA) store used in Python botocore included root CA certificate of authority, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client applications using botocore and cause such applications to connect to malicious sites.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2563319, 2563320, 2563321
Bug Blocks:

Description OSIDB Bzimport 2026-10-29 10:44:57 UTC

Distrust eMudhra intermediate CA certificates due to security concerns in python-botocore

https://emudhra.we-have-a-problem.com/

botocore version 1.43.117 removed the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates:

https://github.com/boto/botocore/pull/3838
https://github.com/boto/botocore/commit/0a6c7b6b3e794e865193dee23c68adfadb6b9c04
https://github.com/boto/botocore/releases/tag/1.43.117

Comment 1 Tomas Hoger 2026-10-29 11:06:15 UTC

botocore attempts to use certificate bundle from Python certifi, and only falls back to using its own cacert.pem if cetfifi is not available:

https://github.com/boto/botocore/blob/1.43.117/botocore/httpsession.py#L95-L100

However, python-botocore packages in Fedora, EPEL, or Red Hat products do not require certifi and hence may use bundled cacert.pem.

Comment 2 Jon Orris 2026-10-30 12:10:43 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 - ELS

Via RHSA-2026:93043 https://access.redhat.com/errata/RHSA-2026:93043

Comment 3 Jon Orris 2026-10-30 12:11:13 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Services on OpenShift 18.0

Via RHSA-2026:93046 https://access.redhat.com/errata/RHSA-2026:93046

Comment 4 Jon Orris 2026-10-30 12:11:15 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2026:93044 https://access.redhat.com/errata/RHSA-2026:93044

Comment 5 Jon Orris 2026-10-30 12:11:31 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 9

Via RHSA-2026:93045 https://access.redhat.com/errata/RHSA-2026:93045