Bug 2563922

Summary: python3.15: Distrust eMudhra intermediate CA certificates due to security concerns [fedora-all]
Product: [Fedora] Fedora Reporter: Tomas Hoger <thoger>
Component: python3.15Assignee: Python Maintainers <python-maint>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: rawhideCC: ksurma, mhroncok, python-maint, python-packagers-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["882790df-2a03-47c0-9af3-603dd9bf12d9"]}
Fixed In Version: python3.15-3.15.2-1.fc44 python3.15-3.15.2-1.fc43 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-11-05 01:25:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2558237    

Description Tomas Hoger 2026-10-30 11:24:46 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Distrust eMudhra intermediate CA certificates due to security concerns in python-certifi

python-certifi version 2026.10.18 removed multiple eMudhra root certificates in order to distrust eMudhra intermediate certificates with weak keys.

https://emudhra.we-have-a-problem.com/
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
https://github.com/certifi/python-certifi/pull/437
https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8

Note that version 2026.10.18 removed all "emSign Root CA" certificates, including those that did not sign the weak intermediate CA certificates. As that removal created problems with access to certain sites, root CAs that did not sign weak intermediate certificates were added back in version 2026.10.19:

https://github.com/certifi/python-certifi/issues/439
https://github.com/certifi/python-certifi/issues/440
https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914
Comment 1 Fedora Update System 2026-10-30 12:25:38 UTC 
FEDORA-2026-4f056db42e (python3.15-3.15.2-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4f056db42e
Comment 2 Fedora Update System 2026-10-30 12:25:41 UTC 
FEDORA-2026-5e4931d206 (python3.15-3.15.2-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-5e4931d206
Comment 3 Fedora Update System 2026-10-30 12:25:48 UTC 
FEDORA-2026-f3fe9323aa (python3.15-3.15.2-1.fc45 and python3-docs-3.15.2-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-f3fe9323aa
Comment 4 Fedora Update System 2026-11-05 01:25:59 UTC 
FEDORA-2026-4f056db42e (python3.15-3.15.2-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 5 Fedora Update System 2026-11-05 01:45:48 UTC 
FEDORA-2026-5e4931d206 (python3.15-3.15.2-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.