Bug 2563321 - python-botocore: Distrust eMudhra intermediate CA certificates due to security concerns [fedora-all]
Summary: python-botocore: Distrust eMudhra intermediate CA certificates due to securit...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: python-botocore
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: David Duncan
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["82f8e4cd-4579-4a10-9f2c-e...
Depends On:
Blocks: 2563310
TreeView+ depends on / blocked
 
Reported: 2026-10-29 11:28 UTC by Tomas Hoger
Modified: 2026-11-05 01:26 UTC (History)
4 users (show)

Fixed In Version: python-botocore-1.43.122-1.fc45 python-botocore-1.43.122-1.fc44
Clone Of:
Environment:
Last Closed: 2026-10-31 18:53:20 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2026-10-29 11:28:37 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Distrust eMudhra intermediate CA certificates due to security concerns in python-botocore

https://emudhra.we-have-a-problem.com/

botocore version 1.43.117 removed the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates:

https://github.com/boto/botocore/pull/3838
https://github.com/boto/botocore/commit/0a6c7b6b3e794e865193dee23c68adfadb6b9c04
https://github.com/boto/botocore/releases/tag/1.43.117

Comment 1 Tomas Hoger 2026-10-29 11:32:12 UTC
I filed this bug even though I noticed the work on updates to version 1.43.117 are already in progress (albeit Koji builds are failing).  The reason for doing so is to ask if we can / should stop shipping or using bundled cacerts in botocore, and switch to using system CA bundle from ca-certificates via python-certifi (see bug 2563310 comment 1).

Comment 2 Fedora Update System 2026-10-30 16:09:18 UTC
FEDORA-2026-443272dc0d (python-boto3-1.43.122-1.fc45 and python-botocore-1.43.122-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-443272dc0d

Comment 3 Fedora Update System 2026-10-30 16:09:36 UTC
FEDORA-2026-c23d8c6e6b (python-boto3-1.43.122-1.fc44 and python-botocore-1.43.122-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c23d8c6e6b

Comment 4 Fedora Update System 2026-10-30 16:10:05 UTC
FEDORA-2026-1f40f6b868 (python-boto3-1.43.122-1.fc43, python-botocore-1.43.122-1.fc43, and 1 more) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-1f40f6b868

Comment 5 Fedora Update System 2026-10-31 02:43:49 UTC
FEDORA-2026-1f40f6b868 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-1f40f6b868`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-1f40f6b868

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-10-31 03:03:17 UTC
FEDORA-2026-c23d8c6e6b has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c23d8c6e6b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c23d8c6e6b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-10-31 05:13:46 UTC
FEDORA-2026-443272dc0d has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-443272dc0d`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-443272dc0d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-10-31 18:53:20 UTC
FEDORA-2026-443272dc0d (python-boto3-1.43.122-1.fc45 and python-botocore-1.43.122-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2026-11-05 01:26:47 UTC
FEDORA-2026-c23d8c6e6b (python-boto3-1.43.122-1.fc44 and python-botocore-1.43.122-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.