Bug 2563344

Summary:	python-httplib2: Distrust eMudhra intermediate CA certificates due to security concerns [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Tomas Hoger <thoger>
Component:	python-httplib2	Assignee:	Kevin Fenzi <kevin>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	dchen, gwync, igor.raits, kevin, pcahyna
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["e6a52f60-61d7-4c7e-950c-6774edf54c33"]}
Fixed In Version:	python-httplib2-0.32.1-1.fc46	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-11-09 02:25:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2563296

Description Tomas Hoger 2026-10-29 12:44:27 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Distrust eMudhra intermediate CA certificates due to security concerns in python-httplib2

https://emudhra.we-have-a-problem.com/

python-httplib2 version 0.32.1 the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates:

https://github.com/httplib2/httplib2/compare/v0.32.0...v0.32.1
https://github.com/httplib2/httplib2/pull/262
https://github.com/httplib2/httplib2/commit/5fee2b095f49a6ad5e1f0a185d909c89199e4dc9

Note that httplib2 uses certificate store from the Python certifi module, if the module is available, and only falls back to the customer version if certifi module is not available.

Comment 1 Tomas Hoger 2026-10-29 12:52:06 UTC

I am aware of the certfile.patch, and that python-httplib2 in Fedora is not really affected by this - see bug 2563296 comment 1.

I decided to file this regardless as the cacerts.txt file is included in RPMs, even though it should not be used.  It therefore got caught when we were searching for eMudhra certificates.  Would it be possible to stop including the file?  Or replace with a symlink to the system bundle form ca-certificates, if there is a need to keep including it?

Comment 2 Kevin Fenzi 2026-11-08 22:25:26 UTC

Yeah, agreed. We should drop it... will look at doing that with the next release.

Comment 3 Fedora Update System 2026-11-09 02:20:58 UTC

FEDORA-2026-c0681b6157 (python-httplib2-0.32.1-1.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c0681b6157

Comment 4 Fedora Update System 2026-11-09 02:25:56 UTC

FEDORA-2026-c0681b6157 (python-httplib2-0.32.1-1.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.