Bug 2563310 - python-botocore: Distrust eMudhra intermediate CA certificates due to security concerns
Summary: python-botocore: Distrust eMudhra intermediate CA certificates due to securit...
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2563319 2563320 2563321
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-29 10:44 UTC by OSIDB Bzimport
Modified: 2026-11-05 11:01 UTC (History)
95 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:93043 0 None None None 2026-10-30 12:10:48 UTC
Red Hat Product Errata RHSA-2026:93044 0 None None None 2026-10-30 12:11:24 UTC
Red Hat Product Errata RHSA-2026:93045 0 None None None 2026-10-30 12:11:35 UTC
Red Hat Product Errata RHSA-2026:93046 0 None None None 2026-10-30 12:11:18 UTC

Description OSIDB Bzimport 2026-10-29 10:44:57 UTC 
Distrust eMudhra intermediate CA certificates due to security concerns in python-botocore

https://emudhra.we-have-a-problem.com/

botocore version 1.43.117 removed the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates:

https://github.com/boto/botocore/pull/3838
https://github.com/boto/botocore/commit/0a6c7b6b3e794e865193dee23c68adfadb6b9c04
https://github.com/boto/botocore/releases/tag/1.43.117
Comment 1 Tomas Hoger 2026-10-29 11:06:15 UTC 
botocore attempts to use certificate bundle from Python certifi, and only falls back to using its own cacert.pem if cetfifi is not available:

https://github.com/boto/botocore/blob/1.43.117/botocore/httpsession.py#L95-L100

However, python-botocore packages in Fedora, EPEL, or Red Hat products do not require certifi and hence may use bundled cacert.pem.
Comment 2 Jon Orris 2026-10-30 12:10:43 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 - ELS

Via RHSA-2026:93043 https://access.redhat.com/errata/RHSA-2026:93043
Comment 3 Jon Orris 2026-10-30 12:11:13 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Services on OpenShift 18.0

Via RHSA-2026:93046 https://access.redhat.com/errata/RHSA-2026:93046
Comment 4 Jon Orris 2026-10-30 12:11:15 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2026:93044 https://access.redhat.com/errata/RHSA-2026:93044
Comment 5 Jon Orris 2026-10-30 12:11:31 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 9

Via RHSA-2026:93045 https://access.redhat.com/errata/RHSA-2026:93045
Note You need to log in before you can comment on or make changes to this bug.