https://seclists.org/oss-sec/2026/q4/337: Information for Python users garding eMudhra / emSign CA certificate security incident
Affected Software
Frequently Asked Questions
Which Python packages are identified as potentially carrying their own certificate-root data?
The discussion identifies requests, pip, sigstore, and botocore as packages with bundled or vendored certificate material. It notes that botocore includes a vendored copy, but its actual use was not verified.
Are distribution-provided Python packages affected in the same way?
The discussion says Linux distribution packages commonly patch certifi, or build it from certifi-system-store, so that the system trust store is used. It also states that distribution-packaged pip is unbundled to use the system requests and, through it, the system certifi.
Does updating sigstore necessarily enforce use of a sufficiently new certifi version?
No. The described sigstore update changed a lockfile to lock a newer certifi, but did not add a dependency requiring a sufficiently new certifi version.
What trust-store configuration is recommended when changing the affected packages is necessary?
The system trust store should be the default source of trust. If using the system store is impossible, the suggested alternative is an option to use certifi as a dependency rather than vendoring it.