Repository navigation
fix(deps): pin certifi to >=2026.10.19 for emSign bundle remediation (GHSA-6q48-6c7w-9gw2) - #659
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
<What changes and why: certifi versions before 2026.10.18 bundle the
emSign ECC Root CA - G3root certificate; eight eMudhra intermediate CA certificates that chain to that root have compromised private keys (GHSA-6q48-6c7w-9gw2, CVSS 4.0 9.1). A holder of a compromised key can mint valid-looking certificates for any hostname, so clients that trust the certifi bundle (requests, urllib3, pip, and the Python.org macOS installer are listed examples) trust the entire chain. This pins certifi to>=2026.10.19in requirements.txt: 2026.10.18 removed all emSign roots from the bundle and 2026.10.19 restored the unaffected ones, so>=2026.10.19is the first version with the compromised intermediates gone and the good roots retained.Refs GHSA-6q48-6c7w-9gw2
Blast radius: none — a dependency pin in requirements.txt; no Ansible roles, hosts, playbooks, or runtime code touched.
Evidence:
Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi(GHSA-6q48-6c7w-9gw2).grep -rn "certifi" --include="*.txt" --include="*.toml" --include="*.md" --include="*.yml"matches only requirements.txt:6; no constraints file, no golang usage in the repo.pip install --dry-run -r requirements.txtcollectscertifi-2026.10.23(satisfies>=2026.10.19).Validation:
pip install --dry-run -r requirements.txtresolves clean (all deps collected, certifi-2026.10.23 pinned);git diff origin/main...HEADis the single requirements.txt line. CI is CodeQL-only (no Docker image builds); release-please parsesfix(deps):to bump the changelog.