Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] Raise certifi >= 2026.10.19 and pip >= 26.2.2 to distrust the compromised eMudhra intermediates

Abierto Apto para principiantes
  • ¿Algo no está bien?
#10,669 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@DOTBave ya está trabajando en esto.

Desde el 21/10/2026.

  • #10670 de @DOTBave — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
docker, python
Área
devops, security

Línea de trabajo

Empieza comprobando las versiones mínimas de certifi y pip en pyproject.toml y requirements.txt; después, sigue el proceso por el que las imágenes de Docker instalan estas dependencias. Eleva las versiones mínimas a las versiones corregidas indicadas en el issue y verifica que una instalación limpia resuelva certifi = 2026.10.19 y pip = 26.2.2; es necesario reconstruir las imágenes antiguas para incluir la corrección.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Description

AstrBot's declared minimum versions of certifi and pip are still vulnerable to the October 2026 eMudhra intermediate-CA compromise:

  • pyproject.toml / requirements.txt: certifi>=2025.4.26
  • pyproject.toml / requirements.txt: pip>=25.1.1

certifi versions before 2026.10.19 bundle the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CAs chaining to that root had trivially recoverable P-384 private keys (d < 256), were revoked on 2026-10-18, and are blocked by browsers through OneCRL/CRLSet. Any client that trusts the root and does not enforce revocation can be MITM'd with a forged leaf certificate for an arbitrary hostname.

AstrBot loads the certifi bundle into its outbound SSL contexts (for example, runtime_bootstrap.py patches aiohttp's verified SSL context to the certifi-backed context, and io.py, zip_updater.py, plugin_service.py use certifi.where()). Plugin dependencies are installed with the in-process pip (pip_installer.py), and pip always adds its vendored certifi to certificate verification. With the current floors, environments can still resolve certifi < 2026.10.19 and pip < 26.2.2 (pip 26.2.2 is the first release that vendors certifi 2026.10.19).

Impact: an on-path attacker holding a compromised intermediate key can impersonate provider APIs (API keys and chat content) and plugin/update endpoints. Core, dashboard, and plugin ZIPs are downloaded over that TLS and executed after extraction, so the issue can escalate to code execution. Docker images built before 2026-10-19 keep the vulnerable certifi/pip baked in until rebuilt.

Reproduction Steps

  1. Install AstrBot v4.29.1 (or an older Docker image) in a clean environment.

  2. Check the resolved trust-store tooling:

    python -c "import certifi; print(certifi.__version__)"
python -m pip --version

    Expected (fixed): certifi >= 2026.10.19 and pip >= 26.2.2.
    Affected environments report something like certifi 2026.7.22 and pip 26.2.1.

  3. Network-position check with the incident test host

    curl https://dv-g3b-emudhra.we-have-a-problem.com/

    A client with a vulnerable trust store completes the handshake; a fixed client returns a certificate error.

AstrBot Version

v4.29.1

Operating System

Linux

Deployment Method

Any

Message Platform Adapter

N/A

Error Log
No error is raised: the vulnerable trust store still validates a chain it should reject. Example from an affected environment:


$ python -c "import certifi; print(certifi.__version__)"
2026.7.22
$ python -m pip --version
pip 26.2.1 ...


A fixed environment reports `certifi 2026.10.19` and `pip 26.2.2`.
Supplementary Information

No response

Checklist
  • I have searched the Issue list for related issues and could not resolve the problem, or this issue has never been reported before.
  • I have tried disabling all plugins to rule out issues caused by plugins.
  • The issue I am reporting is related to AstrBot itself, not to a specific plugin.
  • I have read and agree to the project's Code of Conduct.
  • (Optional) I am willing to submit a PR to help fix this issue.
Lenguaje dominante
Python
Estrellas
42.1k
Forks
3.1k
Merge medio
1 d 2 h
PR fusionados (30 d)
146

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de AstrBotDevs/AstrBot

Todos los issues de AstrBotDevs/AstrBot

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.