From nobody Thu Oct 22 11:40:44 2026 X-Original-To: python@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9PNY3JWNz6wqDF for ; Thu, 22 Oct 2026 11:40:45 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9PNX6BSfz4Rxv for ; Thu, 22 Oct 2026 11:40:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792669245; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T1RUGRYVFmxidicQctenBjuRGO5AsKdSXvWDt4i+O3s=; b=wZZnLtB8WU1dOEZWeOL/MCg1wOBBrQdCoslOTOc8jQhnpWr+JrKPPUDJDJmaJHotC8RMq8 SKM4JrnUjf3OHCX6a5lW0mTEmgQTl4z/QvaBoP2FyIZEeV57ybVt1odOrzNPti2kWF+ebL MciKUywifaBDDrtPJUlvwGoatmpC9k0A7ME5SoMDtAaAmdcoHre8IS/XUqIogYQ3+WwvM/ iChte25P6K9aky3DZVFapMlyt3NpVgQ77w5liEgXgtxFq6johXjoFcLFVnB4Rc/7J/L5f/ +mPqYoBL+J+khOg0uaeOxA1wHopvouK3HuqsPYiixMt+FmIptgr7kUnJNiQn2A== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792669245; b=B/UBwmIfqbTFE+VGQ0YcEdLB9ZgT1V4iefkKJ+fObw/u03/yjhAEG07P4tyeUgWNdMfQq/ GsbHzhZ2BDJQBZcI3F6HZiGKE7iSWzZirQ9ZKXxDZBH99901WBHabK/MzozfBU7LbidTcP wiJWXt8WhCumzlC3xjlq6pIZLQqMoiJG7+A5HBQRXOjAVA3/4twYd9BsmN1FeU9UEw7HlF 3oJWS4pyImUMeGvZy1DeeTRxf+0qX2CWxLEWUVxZOlon+FrBodXZWAYv0p23RwWEqlnnYL SlfhzNUeymjcP0Kw4WOpUnQgUAnjRIzBqw8N2lhQlvv4o4sM4PnvLBl2dw5Jlg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792669245; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T1RUGRYVFmxidicQctenBjuRGO5AsKdSXvWDt4i+O3s=; b=kNXmOSaza1id1Fsgi+07aztbNLP6gE+P3V4OMZvPyHAmO4KCPtmvBcBZz+LTnJpxqcHTSX jHqrED89zK0HYQj3SerZ40Rit7eaxjzJcj7B9qz1e4xZTNpFDXdmbAINqAPPVj4U6HVB5H BCPpvlhYz+JkEGrQ5SMvzc0NaK8Ac1JBWHoQpGiUl5jQLO1aS6x5/osWWY9YP9+pAcibPv tWoKXjXotyoO+VyEnhzS/cTNk5d5gNbpTvooY2pu3Nd/iEgd9DwqxppvY+V4mJlV+E2jxB TbfBhhakJpDjB8mBIE4iuCc16WYcOp+3Fv3UBWAZaIgiu2SYqsnrx32xYL3GCA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4j9PNX5KvyzgrV for ; Thu, 22 Oct 2026 11:40:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 69MBeiKl050590 for ; Thu, 22 Oct 2026 11:40:44 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 69MBeir6050589 for python@FreeBSD.org; Thu, 22 Oct 2026 11:40:44 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: python@FreeBSD.org Subject: [Bug 299701] devel/py-pip: compromised certificates due to eMudhra incident Date: Thu, 22 Oct 2026 11:40:44 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: bugzilla@tunedal.net X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: python@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter flagtypes.name Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Archive: https://lists.freebsd.org/archives/freebsd-python X-BeenThere: freebsd-python@freebsd.org Sender: owner-freebsd-python@FreeBSD.org List-Id: FreeBSD-specific Python issues List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D299701 Bug ID: 299701 Summary: devel/py-pip: compromised certificates due to eMudhra incident Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: python@FreeBSD.org Reporter: bugzilla@tunedal.net Flags: maintainer-feedback?(python@FreeBSD.org) Assignee: python@FreeBSD.org pip bundles its own CA certificates, which it uses in addition to the system certificates. These need to be updated to provent MITM attacks due to the recent eMudhra incident. See discussion: https://discuss.python.org/t/information-for-python-users-regarding-emudhra= -emsign-ca-certificate-security-incident/109576 The best option might be to do what Debian does and patch pip to only use t= he system certificates: https://salsa.debian.org/python-team/packages/python-pip/-/blob/master/debi= an/patches/certifi-debian-ca-certificates.patch?ref_type=3Dheads Otherwise pip needs to be updated to a version that includes an updated certificate bundle. --=20 You are receiving this mail because: You are the assignee for the bug.=