Bug 2563296 - python-httplib2: Distrust eMudhra intermediate CA certificates due to security concerns
Summary: python-httplib2: Distrust eMudhra intermediate CA certificates due to securit...
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2563344
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-29 09:51 UTC by OSIDB Bzimport
Modified: 2026-11-12 19:14 UTC (History)
39 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:99693 0 None None None 2026-11-12 19:14:34 UTC

Description OSIDB Bzimport 2026-10-29 09:51:01 UTC 
Distrust eMudhra intermediate CA certificates due to security concerns in python-httplib2

https://emudhra.we-have-a-problem.com/

python-httplib2 version 0.32.1 removed the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates:

https://github.com/httplib2/httplib2/compare/v0.32.0...v0.32.1
https://github.com/httplib2/httplib2/pull/262
https://github.com/httplib2/httplib2/commit/5fee2b095f49a6ad5e1f0a185d909c89199e4dc9

Note that httplib2 uses certificate store from the Python certifi module, if the module is available, and only falls back to the customer version if certifi module is not available.
Comment 1 Tomas Hoger 2026-10-29 10:15:18 UTC 
While python-httlib2 RPM packages in Fedora, EPEL, or Red Hat products such as RHEL include cacerts.txt file, the library is modified to not load that file and use system certificate bundle from the ca-certificates package instead.  Therefore, they are not affected by this issue.

https://src.fedoraproject.org/rpms/python-httplib2/blob/5000171539/f/python-httplib2.certfile.patch
Comment 3 errata-xmlrpc 2026-11-12 19:14:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.8 Extended Update Support

Via RHSA-2026:99693 https://access.redhat.com/errata/RHSA-2026:99693
Note You need to log in before you can comment on or make changes to this bug.