Attestkeep
Language: English
Sign up

Vulnerabilities / GHSA-6q48-6c7w-9gw2

critical

GHSA-6q48-6c7w-9gw2

certifi bundles emSign root CAs with compromised intermediate CA keys

Published Modified
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

GHSA9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Trivy's own label is CRITICAL. Rated critical by GHSA.

Description

Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer. Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.

Affected packages and fixed versions

SourcePackageFixed in
pip::GitHub Security Advisory pipcertifi2026.10.18
echo pip::Echo OSVcertifi2026.10.19
rapidfort fedora 41python-certifi, python3-certifi0:2023.05.07-8.fc41
rapidfort fedora 43python-certifi, python3-certifi0:2025.07.09-4.fc43
rapidfort Oracle Linux 10python3-certifino fix listed
rapidfort Oracle Linux 9python3-certifino fix listed
Show all 8 entries from 6 sources
SourcePackageFixed in
pip::GitHub Security Advisory pipcertifi2026.10.18
echo pip::Echo OSVcertifi2026.10.19
rapidfort fedora 41python-certifi0:2023.05.07-8.fc41
rapidfort fedora 41python3-certifi0:2023.05.07-8.fc41
rapidfort fedora 43python-certifi0:2025.07.09-4.fc43
rapidfort fedora 43python3-certifi0:2025.07.09-4.fc43
rapidfort Oracle Linux 10python3-certifino fix listed
rapidfort Oracle Linux 9python3-certifino fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.