Gregory P. SmithandChristian Heimes e9bf2cf84e [3.14] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160569) ...

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

---------




(cherry picked from commit 7dd8b4736a)

Co-authored-by: Christian Heimes <christian@python.org>

2026-10-24 00:17:26 -07:00

..

clinic

gh-131525: Cache the result of tuple_hash (#131529)

2025-03-27 09:57:06 -04:00

cert.c

gh-111178: fix UBSan failures in Modules/_ssl.c (GH-130719)

2025-03-17 16:25:28 +01:00

debughelpers.c

[3.14] gh-159739: Release SSL resources on error paths (GH-159745) (#159762)

2026-10-19 21:36:44 +00:00

distrusted_spki.h

[3.14] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160569)

2026-10-24 00:17:26 -07:00

misc.c

bpo-18233: Add internal methods to access peer chain (GH-25467)

2021-04-26 15:01:40 +02:00