Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / GHSA-6q48-6c7w-9gw2

crítica

GHSA-6q48-6c7w-9gw2

certifi bundles emSign root CAs with compromised intermediate CA keys

Publicada Modificada
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

GHSA9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA.

Descripción

Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer. Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
pip::GitHub Security Advisory pipcertifi2026.10.18
echo pip::Echo OSVcertifi2026.10.19
rapidfort fedora 41python-certifi, python3-certifi0:2023.05.07-8.fc41
rapidfort fedora 43python-certifi, python3-certifi0:2025.07.09-4.fc43
rapidfort Oracle Linux 10python3-certifisin corrección indicada
rapidfort Oracle Linux 9python3-certifisin corrección indicada
Mostrar las 8 entradas de 6 fuentes
FuentePaqueteCorregido en
pip::GitHub Security Advisory pipcertifi2026.10.18
echo pip::Echo OSVcertifi2026.10.19
rapidfort fedora 41python-certifi0:2023.05.07-8.fc41
rapidfort fedora 41python3-certifi0:2023.05.07-8.fc41
rapidfort fedora 43python-certifi0:2025.07.09-4.fc43
rapidfort fedora 43python3-certifi0:2025.07.09-4.fc43
rapidfort Oracle Linux 10python3-certifisin corrección indicada
rapidfort Oracle Linux 9python3-certifisin corrección indicada

Referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.