Member-only story
Python Just Shipped Five Security Releases. Here’s Why.
Compromised eMudhra CA keys pushed Python to add protection directly to ssl, just days after the first pip and certifi response.
Python has just released five security updates at once.
If you only want to know what you should do right now, jump straight to the “What Python developers should do now” section below.
Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 were announced on October 26 as what the Python release team calls “expedited security releases.”
The reason is unusual.
Eight intermediate certificate authority keys belonging to eMudhra were found to be cryptographically weak. Their private keys could be reconstructed from information that should never have made that possible.
Python already responded to this incident once, five days ago, by updating pip and certifi.
Now the project has gone one step further.
The compromised keys are blocked directly inside Python’s ssl module.
That makes this more interesting than a routine patch release.
What happened?
On October 17, a security researcher reported that eight intermediate certificate authorities operated by eMudhra had weak…
