Information for Python users regarding eMudhra / emSign CA certificate security
Comments on “Information for Python users regarding eMudhra / emSign CA certificate security”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Eight eMudhra intermediate CA certificates were compromised, and the Python ecosystem has shipped fixes. Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 now block the keys in the ssl module (CVE-2026-115557, CVSS 9.4). Separately, pip 26.2.2, certifi 2026.10.19 and uv 0.13.4 are recommended. Forum commenters say older pip keeps trusting the keys through its vendored certifi, and that the keys were trivially guessable; neither claim is sourced. Official Docker images still ship pip 26.2.1, so rebuild images and virtualenvs.
Why it ranked
No. 2 of 124 with a score of 0.77. The panel rated it highest on practical relevance (0.95) and reader interest (0.85), lowest on new information (0.49). The judges disagreed most on overclaim (spread 0.55), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.2Contestedjudges differ by 0.52 on new information, 0.55 on overclaim
- Significance0.74
- Reader interest0.85
- Audience breadth0.77
- Practical relevance0.95
- Substantiated0.75
- Technical depth0.83
- New information0.49
- Counts against: Promotional0.04
- Counts against: Overclaim0.32
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.74 | 0.72 | 0.76 | 0.74 | 0.04 | +0.24 | +0.178 |
| Reader interest | 0.75 | 0.90 | 0.90 | 0.85 | 0.15 | +0.26 | +0.221 |
| Audience breadth | 0.73 | 0.85 | 0.72 | 0.77 | 0.13 | +0.13 | +0.100 |
| Practical relevance | 0.99 | 0.92 | 0.94 | 0.95 | 0.07 | +0.22 | +0.209 |
| Substantiated | 0.67 | 0.70 | 0.88 | 0.75 | 0.21 | +0.05 | +0.038 |
| Technical depth | 0.99 | 0.72 | 0.78 | 0.83 | 0.27 | +0.05 | +0.042 |
| New information | 0.70 | 0.60 | 0.18 | 0.49 | 0.52 , above the contested threshold | +0.05 | +0.025 |
| Promotional | 0.06 | 0.03 | 0.02 | 0.04 | 0.04 | −0.19 | −0.007 |
| Overclaim | 0.63 | 0.25 | 0.08 | 0.32 | 0.55 , above the contested threshold | −0.11 | −0.035 |
| Sum of contributions | +0.769 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.769 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/2/"><img src="https://rubric.hrih.si/badge/2026-10-27/2.svg" alt="Ranked #2 on Rubric, 27 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 matches source · 2 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkCausal conclusion
A security incident affecting eMudhra intermediate certificates has required removing the emSign root CA certificate from CA bundles such as certifi.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A security incident affecting eMudhra intermediate certificates has required removing the emSign root CA certificate from CA bundles such as “certifi”
The source says No passage could be compared.
Source cited by the article: emudhra.we-have-a-problem.com
Matches sourceVersion
Python has published releases 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 that automatically reject the compromised intermediate certificates, regardless of whether the emSign root CA certificate is in use by certifi.
The cited source says the same thing.
The article says “Python has also published releases which automatically reject the compromised intermediate certificates, regardless of whether the emSign root CA certificate is in use by “certifi”
The source says “They address the compromised eMudhra intermediate CA keys . These keys are now blocked by the ssl module as a last resort against their use”
Source cited by the article: discuss.python.org/t/python-3-15-2-3-14-10-3-13-18-3-12-16-and-3-11-18-are-out/109678
Matches sourceDate
Python versions 3.10 and older are end-of-life and no longer eligible for security fixes.
The cited source says the same thing.
The article says “Python versions 3.10 and older are end-of-life and no longer eligible for security fixes”
The source says “3.10 | PEP 619 | end-of-life | 2021-10-04 | 2026-10-01 | Pablo Galindo Salgado”
Source cited by the article: devguide.python.org/versions
Couldn’t checkVersion
The certifi advisory mentions 2026.10.18, but certifi 2026.10.19 is recommended for compatibility with unaffected emSign root certificates.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Advisory mentions 2026.10.18, but 2026.10.19 is recommended for compatibility with unaffected emSign root certificates”
The source says No passage could be compared.
Source cited by the article: github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
Couldn’t checkCausal conclusion
Any pip older than 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, because pip always loads CA certificates from its vendored certifi and there is no supported way to disable this.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough”
The source says No passage could be compared.
Source cited by the article: github.com/pypa/pip/issues/14374
No source givenNumber
The security incident is a bad private key: all 8 eMudhra CAs had private keys with d < 256.
The article gives no link or citation for it.
The article says “All 8 eMudhra CAs had private keys with d < 256”
The source says No source to compare with.
No source givenVersion
Golang has released a mitigation that blocks the compromised intermediate CAs by SPKI hash.
The article gives no link or citation for it.
The article says “Golang has implemented and released a mitigation that blocks the compromised intermediate CAs by SPKI hash (subject public key information”
The source says No source to compare with.
Matches sourceVersion
The official Docker python:3.15-slim-trixie image ships pip 26.2.1, which is vulnerable.
The cited source says the same thing.
The article says “It appears that pip is still vulnerable in the latest official docker images”
The source says “pip 26.2.1 from /usr/local/lib/python3.15/site-packages/pip (python 3.15”
Source cited by the article: github.com/docker-library/python/issues/1142
Also covered by
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.