Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / GHSA-6q48-6c7w-9gw2

kritisch

GHSA-6q48-6c7w-9gw2

certifi bundles emSign root CAs with compromised intermediate CA keys

Veröffentlicht Geändert
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

GHSA9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA.

Beschreibung

Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer. Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
pip::GitHub Security Advisory pipcertifi2026.10.18
echo pip::Echo OSVcertifi2026.10.19
rapidfort fedora 41python-certifi, python3-certifi0:2023.05.07-8.fc41
rapidfort fedora 43python-certifi, python3-certifi0:2025.07.09-4.fc43
rapidfort Oracle Linux 10python3-certifikein Fix angegeben
rapidfort Oracle Linux 9python3-certifikein Fix angegeben
Alle 8 Einträge aus 6 Quellen zeigen
QuellePaketBehoben in
pip::GitHub Security Advisory pipcertifi2026.10.18
echo pip::Echo OSVcertifi2026.10.19
rapidfort fedora 41python-certifi0:2023.05.07-8.fc41
rapidfort fedora 41python3-certifi0:2023.05.07-8.fc41
rapidfort fedora 43python-certifi0:2025.07.09-4.fc43
rapidfort fedora 43python3-certifi0:2025.07.09-4.fc43
rapidfort Oracle Linux 10python3-certifikein Fix angegeben
rapidfort Oracle Linux 9python3-certifikein Fix angegeben

Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.