Upgrade certifi to >= 2026.10.19 in uv.lock to mitigate eMudhra intermediate CA compromise

Abierto Apto para principiantes
  • ¿Algo no está bien?
#10,355 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
devops, security

Línea de trabajo

Empieza comprobando la versión fijada de certifi en uv.lock y el comando de actualización propuesto en el issue. Actualiza el archivo de bloqueo a certifi >= 2026.10.19 y luego ejecuta el fragmento de verificación de Python proporcionado con la URL de prueba indicada; se considera terminado cuando la conexión falla con un error de verificación SSL.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

A major security incident (emudhra.we-have-a-problem.com) has compromised eight intermediate Certificate Authorities (CAs) operated by eMudhra (cross-signed by Sectigo / AAA Certificate Services). Due to a key generation flaw with virtually zero entropy, the private keys for these intermediate CAs can be computed directly from public certificates.

Anyone with these private keys can forge valid TLS/SSL certificates for any domain on the internet. While desktop web browsers have already pushed emergency revocation blocks (OneCRL, CRLSets, Apple CTL), non-browser clients—such as Python HTTP libraries (requests, httpx, certifi), curl, and uv—do not check revocation lists by default and will trust forged certificates until their CA bundles are patched.

Affected Areas in policyengine-us
  • uv.lock currently pins certifi == 2026.1.4.
  • certifi < 2026.10.19 accepts the compromised eMudhra intermediate certificates.
  • Outbound HTTPS requests made through Python using certifi are vulnerable to MitM attacks on untrusted networks.
  • Developer and CI packaging tools: uv prior to 0.13.4 and pip prior to 26.2.2 are susceptible to intercepted package downloads if not updated.

(Note: Other PolicyEngine repos like policyengine-household-api and policyengine-core should also update their lockfiles and Docker base images/ca-certificates.)

Verification / Steps to Reproduce

Run the following script using the current virtual environment (certifi 2026.1.4):

import certifi, ssl, urllib.request

ctx = ssl.create_default_context(cafile=certifi.where())
try:
    urllib.request.urlopen("https://dv-g3b-emudhra.we-have-a-problem.com/", context=ctx)
    print("❌ VULNERABLE: Connected using compromised eMudhra intermediate CA")
except Exception as e:
    print("✅ SECURE: Connection rejected:", e)

Observed behavior (certifi 2026.1.4):

❌ VULNERABLE: Connected using compromised eMudhra intermediate CA

Expected behavior (certifi >= 2026.10.19):

✅ SECURE: Connection rejected: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate>
Proposed Remediation
  • Upgrade certifi to >= 2026.10.19 in uv.lock: 
    uv lock --upgrade-package certifi
uv sync
  • Verify that running the test snippet above against https://dv-g3b-emudhra.we-have-a-problem.com/ fails with an SSL verification error.
References
Lenguaje dominante
Python
Estrellas
171
Forks
217
Merge medio
4 d 21 h
PR fusionados (30 d)
333

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de PolicyEngine/policyengine-us

Todos los issues de PolicyEngine/policyengine-us

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.