ilusha/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2026-10-30 08:11:56 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
cpython/Modules/_ssl
History
Exact
Gregory P. Smith 98f0e4ed34
[3.13] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160570) 
The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

(cherry picked from commit 7dd8b4736a)

Co-authored-by: Christian Heimes <christian@python.org>
2026-10-24 12:28:52 -07:00
..
clinic
cert.c
debughelpers.c [3.13] gh-156166: Fix setting and deleting SSLContext._msg_callback (GH-156167) (GH-156175) 2026-08-21 16:48:12 +03:00
distrusted_spki.h [3.13] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160570) 2026-10-24 12:28:52 -07:00
misc.c