3 people af52b41afa [3.11] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (GH-160572) ...

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

(cherry picked from commit 7dd8b4736a)

Co-authored-by: Christian Heimes <christian@python.org>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

2026-10-24 16:10:44 -07:00

..

clinic

gh-91320: Argument Clinic uses _PyCFunction_CAST() (#32210)

2022-05-03 20:25:41 +02:00

cert.c

bpo-43908: Mark ssl, hash, and hmac types as immutable (GH-25792)

2021-05-02 09:47:45 +02:00

debughelpers.c

bpo-42333: Port _ssl extension to multiphase initialization (PEP 489) (GH-23253)

2021-04-17 20:06:38 +02:00

distrusted_spki.h

[3.11] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (GH-160572)

2026-10-24 16:10:44 -07:00

misc.c

bpo-18233: Add internal methods to access peer chain (GH-25467)

2021-04-26 15:01:40 +02:00