https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299701
Bug ID: 299701
Summary: devel/py-pip: compromised certificates due to eMudhra
incident
Product: Ports & Packages
Version: Latest
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: Individual Port(s)
Assignee: [email protected]
Reporter: [email protected]
Flags: maintainer-feedback?([email protected])
Assignee: [email protected]
pip bundles its own CA certificates, which it uses in addition to the system
certificates. These need to be updated to provent MITM attacks due to the
recent eMudhra incident.
See discussion:
https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
The best option might be to do what Debian does and patch pip to only use the
system certificates:
https://salsa.debian.org/python-team/packages/python-pip/-/blob/master/debian/patches/certifi-debian-ca-certificates.patch?ref_type=heads
Otherwise pip needs to be updated to a version that includes an updated
certificate bundle.
--
You are receiving this mail because:
You are the assignee for the bug.
