ilusha/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2026-10-30 08:11:56 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
cpython/Modules/_ssl
History
Exact
Gregory P. Smith a17d9ef549
[3.12] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160571) 
The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

(cherry picked from commit 7dd8b4736a)

Co-authored-by: Christian Heimes <christian@python.org>
2026-10-24 12:30:46 -07:00
..
clinic
cert.c
debughelpers.c
distrusted_spki.h [3.12] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160571) 2026-10-24 12:30:46 -07:00
misc.c