Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Distrust eMudhra intermediate CA certificates due to security concerns in python-httplib2 https://emudhra.we-have-a-problem.com/ python-httplib2 version 0.32.1 the Comodo AAA Certificate Services root CA to distrust eMudhra intermediate certificates: https://github.com/httplib2/httplib2/compare/v0.32.0...v0.32.1 https://github.com/httplib2/httplib2/pull/262 https://github.com/httplib2/httplib2/commit/5fee2b095f49a6ad5e1f0a185d909c89199e4dc9 Note that httplib2 uses certificate store from the Python certifi module, if the module is available, and only falls back to the customer version if certifi module is not available.
I am aware of the certfile.patch, and that python-httplib2 in Fedora is not really affected by this - see bug 2563296 comment 1. I decided to file this regardless as the cacerts.txt file is included in RPMs, even though it should not be used. It therefore got caught when we were searching for eMudhra certificates. Would it be possible to stop including the file? Or replace with a symlink to the system bundle form ca-certificates, if there is a need to keep including it?
Yeah, agreed. We should drop it... will look at doing that with the next release.
FEDORA-2026-c0681b6157 (python-httplib2-0.32.1-1.fc46) has been submitted as an update to Fedora 46. https://bodhi.fedoraproject.org/updates/FEDORA-2026-c0681b6157
FEDORA-2026-c0681b6157 (python-httplib2-0.32.1-1.fc46) has been pushed to the Fedora 46 stable repository. If problem still persists, please make note of it in this bug report.