-------- Forwarded Message --------
Subject: [Security-announce][GHSA-6q48-6c7w-9gw2] CRITICAL security update for
certifi, removal of emSign root certificate
Date: Tue, 20 Oct 2026 14:03:26 +0000
From: Seth Larson <[email protected]>
Reply-To: [email protected]
To: [email protected]
There is a CRITICAL severity vulnerability affecting certifi.
Certifi 2026.10.19 removes root certificates from "emSign" from the root store.
These root certificates have intermediates which have been revoked due to key
compromise. A compromised key for a certificate authority can be used to issue
certificates to enable MITM attacks.
Upgrade to certifi 2026.10.19 and rebuild container images to refresh CA
certificate stores.
Please see the links for the latest information on affected versions:
*
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
*
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
_______________________________________________
Security-announce mailing list -- [email protected]
https://mail.python.org/mailman3//lists/security-announce.python.org
