From 38cd2cabe275273b876ff27678366f1da8153522 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Sat, 24 Oct 2026 12:56:23 +0200 Subject: [PATCH] gh-160040: Add ssl eMudhra distrust entry to whatsnew [3.13] Signed-off-by: Christian Heimes --- Doc/whatsnew/3.13.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Doc/whatsnew/3.13.rst b/Doc/whatsnew/3.13.rst index fdf2c656deb25d..905587e4a6da46 100644 --- a/Doc/whatsnew/3.13.rst +++ b/Doc/whatsnew/3.13.rst @@ -2867,3 +2867,18 @@ tarfile :func:`~tarfile.TarFile.errorlevel` is zero. (Contributed by Matt Prodani and Petr Viktorin in :gh:`112887` and :cve:`2025-4435`.) + + +Notable changes in 3.13.18 +========================== + +ssl +--- + +* The :mod:`ssl` module now rejects TLS certificate chains that contain one + of a set of compromised eMudhra intermediate CA certificates. The affected + certificates are identified by their public key, so cross-signed copies that + reuse the same key are blocked as well. It is a defense-in-depth backstop + that applies even when an application supplies its own root CA bundle, and + regardless of whether the platform trust store has removed trust. + (Contributed by Christian Heimes in :gh:`160040` for :cve:`2026-115557`.)