Bug 2563689

Summary:	python3.13-pip: Distrust eMudhra intermediate CA certificates due to security concerns [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Tomas Hoger <thoger>
Component:	python3.13-pip	Assignee:	Python Maintainers <python-maint>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	epel10	CC:	ksurma, mhroncok, python-maint, python-packagers-sig
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["882790df-2a03-47c0-9af3-603dd9bf12d9"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-30 09:34:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2558237

Description Tomas Hoger 2026-10-29 21:16:20 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Distrust eMudhra intermediate CA certificates due to security concerns in python-certifi

python-certifi version 2026.10.18 removed multiple eMudhra root certificates in order to distrust eMudhra intermediate certificates with weak keys.

https://emudhra.we-have-a-problem.com/
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
https://github.com/certifi/python-certifi/pull/437
https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8

Note that version 2026.10.18 removed all "emSign Root CA" certificates, including those that did not sign the weak intermediate CA certificates. As that removal created problems with access to certain sites, root CAs that did not sign weak intermediate certificates were added back in version 2026.10.19:

https://github.com/certifi/python-certifi/issues/439
https://github.com/certifi/python-certifi/issues/440
https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914

Comment 1 Miro Hrončok 2026-10-30 09:34:00 UTC

Not impacted, see https://src.fedoraproject.org/rpms/python3.13-pip/blob/epel10/f/dummy-certifi.patch