Repository navigation
Distrust eMudhra's CA roots and Sectigo's AAA root for registry, OSV and Socket requests - #11
Merged
Merged
Conversation
The keys of 8 eMudhra (emSign) intermediate CAs were guessable. Browsers block those intermediates, but macOS's default bundle still trusts the roots above them. Requests now use Python's default roots minus eMudhra's.
Each compromised eMudhra intermediate has a twin cross-signed by AAA Certificate Services, which macOS's /etc/ssl/cert.pem still trusts, so dropping the emSign roots alone left a path open.
adamtty
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The private keys of 8 eMudhra (emSign) intermediate CAs turned out to be guessable. Browsers block those intermediates, but the roots above them are still in macOS's
/etc/ssl/cert.pem, which/usr/bin/python3trusts. Anyone holding one of those keys could pass for PyPI, OSV or Socket.tls_context()loads Python's default roots:$SSL_CERT_FILE, else its default file, else its default folder. It leaves out any root whose SHA-256 is one of eMudhra's four, or whose DER names eMudhra. Bothurlopencalls use it.$SSL_CERT_FILEis honoured and filtered.Checked live: PyPI verifies fine through the filtered context.
Sectigo AAA: each compromised intermediate also has a twin cross-signed by Sectigo's legacy AAA Certificate Services root. Browsers and certifi dropped AAA in 2025, but macOS's
/etc/ssl/cert.pemstill trusts it, so it is dropped too (by SHA-256). Checked live without it: PyPI, OSV, Socket, the GitHub API, raw, release assets, npm, crates.io, RubyGems and the Go proxy all still verify.