https://seclists.org/oss-sec/2026/q4/333: Information for Python users garding eMudhra / emSign CA certificate security incident

Q: Which Python packages should be reviewed and upgraded?

The notice identifies certifi, pip, uv, sigstore, conda, and pixi. It also notes that botocore includes a vendored copy, but its use was not verified in the provided information.

Q: What should teams do when rebuilding containerized applications?

Rebuild container images with layer caching disabled after upgrading the relevant software. This is specifically called out to avoid retaining older CA-bundle content in cached image layers.

Q: How should applications obtain trusted CA certificates going forward?

The provided guidance argues that packages other than certifi should stop vendoring root certificates and use the operating system trust store by default, such as a distribution's ca-certificates package. If use of the system store is impossible, it recommends making certifi a dependency rather than vendoring it.

Published Oct 22, 2026

Updated

Affected Software

6 affected components

pypi/certifi<2026.10.19

pypi/pip<26.2.2

pypi/uv<0.13.4

pypi/sigstore<4.5.1

pypi/conda<26.9.4

pixi<0.82.1

Frequently Asked Questions

Which Python packages should be reviewed and upgraded?

The notice identifies certifi, pip, uv, sigstore, conda, and pixi. It also notes that botocore includes a vendored copy, but its use was not verified in the provided information.

What should teams do when rebuilding containerized applications?

Rebuild container images with layer caching disabled after upgrading the relevant software. This is specifically called out to avoid retaining older CA-bundle content in cached image layers.

How should applications obtain trusted CA certificates going forward?

The provided guidance argues that packages other than certifi should stop vendoring root certificates and use the operating system trust store by default, such as a distribution's ca-certificates package. If use of the system store is impossible, it recommends making certifi a dependency rather than vendoring it.