https://seclists.org/oss-sec/2026/q4/330: Information for Python users garding eMudhra / emSign CA certificate security incident

Q: Which certifi release should be used given the advisory’s differing version references?

Use certifi 2026.10.19 or later. Although the advisory mentions 2026.10.18, version 2026.10.19 is recommended for compatibility with unaffected emSign root certificates.

Q: Do containerized Python workloads require more than a package update?

Yes. Rebuild container images with layer caching disabled so the image retrieves the updated system certificate set rather than retaining cached certificate layers.

Q: What should be done with existing Python virtual environments?

Upgrade pip and uv in every existing virtual environment on the system to their latest versions. The guidance recommends first updating pip securely, then using that pip installation to upgrade certifi and uv.

Published Oct 22, 2026

Updated

Affected Software

6 affected components

pypi/certifi<2026.10.19

pypi/pip<26.2.2

pypi/uv<0.13.4

pypi/sigstore<4.5.1

conda/conda<26.9.4

pixi/pixi<0.82.1

Frequently Asked Questions

Which certifi release should be used given the advisory’s differing version references?

Use certifi 2026.10.19 or later. Although the advisory mentions 2026.10.18, version 2026.10.19 is recommended for compatibility with unaffected emSign root certificates.

Do containerized Python workloads require more than a package update?

Yes. Rebuild container images with layer caching disabled so the image retrieves the updated system certificate set rather than retaining cached certificate layers.

What should be done with existing Python virtual environments?

Upgrade pip and uv in every existing virtual environment on the system to their latest versions. The guidance recommends first updating pip securely, then using that pip installation to upgrade certifi and uv.