ilusha/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2026-11-06 09:02:40 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 20
cpython/Modules/_ssl
History
Exact
Gregory P. Smith e9bf2cf84e
[3.14] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160569) 
The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

---------




(cherry picked from commit 7dd8b4736a)

Co-authored-by: Christian Heimes <christian@python.org>
2026-10-24 00:17:26 -07:00
..
clinic gh-131525: Cache the result of tuple_hash (#131529) 2025-03-27 09:57:06 -04:00
cert.c
debughelpers.c [3.14] gh-159739: Release SSL resources on error paths (GH-159745) (#159762) 2026-10-19 21:36:44 +00:00
distrusted_spki.h [3.14] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (#160569) 2026-10-24 00:17:26 -07:00
misc.c