eMudhra/emSign CA compromise (October 2026): what Cloud SDK Python Libraries developers need to do
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 15/100
Research direction
The issue is a security notice listing affected dependencies and fixed versions; it does not name a repository file or test. Start by checking the project’s security or release documentation and its dependency guidance. Done means developers can find the affected packages and the stated upgrade versions; the issue is locked, so it gives no path for questions or discussion.
Written by the indexing model from the issue text.
Description
Summary
Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.
The following packages are affected
certifiearlier than 2026.10.19 (REST transports).httplib2earlier than 0.32.1, used bygoogle-api-python-clientandgoogle-auth-httplib2; its bundled trust store is used whencertifiis not installed.grpcioearlier than 1.84.1 (gRPC transports); bundled root store, does not read the operating system trust store.
You can take the following actions to resolve these issues
- Upgrade
certifito 2026.10.19 or later. - Upgrade
httplib2to 0.32.1 or later. - Upgrade
grpcioto 1.84.1 or later. Patch releases for earlier release lines are being published; see GHSA-2xm2-c8xx-p9vh for the current list of fixed versions.
Advisories:
- GHSA-6q48-6c7w-9gw2 (
certifi) - GHSA-2xm2-c8xx-p9vh (
grpcio)
Google Cloud Security Bulletin: GCP-2026-075.
This issue is locked. Please open a new issue for questions.
- Dominant language
- Python
- Stars
- 9k
- Forks
- 2.6k
- Avg merge
- 28m
- Merged PRs (30d)
- 4
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-api-python-client
-
fix: @_helpers.positional raises TypeError when decorating functions without default argumentsPossibly taken @codeXsidd claimed this 22 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Disable prettyPrint by default for Google Sheets API responsesPossibly taken @pawciobiel claimed this 91 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
test: connection leak test test_discovery_http_is_closed is shadowed and syntactically invalidPossibly taken @Capstan claimed this 167 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
googleapis/google-api-python-client#2757 · 1 comment ·
-
test: strict positional parameter enforcement is ignored under pytestPossibly taken @Capstan claimed this 167 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
All issues in googleapis/google-api-python-client
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dbt-labs/spark-utils#51 ·
-
bug pydanty:is-working
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pydantic/pydantic-ai#13444 ·
Maintainers usually reply within 1 day
-
good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
good first issue help wanted
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
changelog investigate
Difficulty 1/5 Under an hour Newbie friendliness 68/100
ramnes/notion-sdk-py#502 ·