eMudhra/emSign CA compromise (October 2026): what Cloud SDK Python Libraries developers need to do

Aberta
  • Algo errado?
#2,852 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
1/5
Tempo estimado
Menos de uma hora
Facilidade para iniciantes
15/100
Tipo de issue
Documentação
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
python
Domínio
backend, security

Direção de pesquisa

The issue is a security notice listing affected dependencies and fixed versions; it does not name a repository file or test. Start by checking the project’s security or release documentation and its dependency guidance. Done means developers can find the affected packages and the stated upgrade versions; the issue is locked, so it gives no path for questions or discussion.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages are affected

  • certifi earlier than 2026.10.19 (REST transports).
  • httplib2 earlier than 0.32.1, used by google-api-python-client and google-auth-httplib2; its bundled trust store is used when certifi is not installed.
  • grpcio earlier than 1.84.1 (gRPC transports); bundled root store, does not read the operating system trust store.

You can take the following actions to resolve these issues

  • Upgrade certifi to 2026.10.19 or later.
  • Upgrade httplib2 to 0.32.1 or later.
  • Upgrade grpcio to 1.84.1 or later. Patch releases for earlier release lines are being published; see GHSA-2xm2-c8xx-p9vh for the current list of fixed versions.

Advisories:

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.

Linguagem predominante
Python
Estrelas
9k
Forks
2.6k
Merge médio
28min
PRs com merge (30d)
4

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de googleapis/google-api-python-client

Todas as issues de googleapis/google-api-python-client

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.