Christian HeimesandClaude Opus 4.8 7dd8b4736a gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) ...

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

---------

Signed-off-by: Christian Heimes <christian@python.org>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-10-24 05:40:49 +00:00

..

clinic

gh-131525: Cache the result of tuple_hash (#131529)

2025-03-27 09:57:06 -04:00

cert.c

gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217)

2026-03-25 07:44:47 +01:00

debughelpers.c

gh-159739: Release SSL resources on error paths (GH-159745)

2026-10-19 20:42:04 +00:00

distrusted_spki.h

gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042)

2026-10-24 05:40:49 +00:00

misc.c

bpo-18233: Add internal methods to access peer chain (GH-25467)

2021-04-26 15:01:40 +02:00