[Bug 299701] devel/py-pip: compromised certificates due to eMudhra incident

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299701

            Bug ID: 299701
           Summary: devel/py-pip: compromised certificates due to eMudhra
                    incident
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: python@FreeBSD.org
          Reporter: bugzilla@tunedal.net
             Flags: maintainer-feedback?(python@FreeBSD.org)
          Assignee: python@FreeBSD.org

pip bundles its own CA certificates, which it uses in addition to the system
certificates. These need to be updated to provent MITM attacks due to the
recent eMudhra incident.

See discussion:
https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

The best option might be to do what Debian does and patch pip to only use the
system certificates:
https://salsa.debian.org/python-team/packages/python-pip/-/blob/master/debian/patches/certifi-debian-ca-certificates.patch?ref_type=heads

Otherwise pip needs to be updated to a version that includes an updated
certificate bundle.

-- 
You are receiving this mail because:
You are the assignee for the bug.