Denylist for Compromised Certificates in Python SSL Module

Executive Summary

This vulnerability involves compromised eMudhra intermediate CA keys that were used to sign certificates. Python added a denylist to its SSL module to automatically reject these compromised certificates during TLS verification, even if certificate revocation checks are not properly configured. This prevents potential man-in-the-middle attacks by blocking affected certificate chains.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Python version includes the denylist for compromised eMudhra intermediate CA keys. Use commands like 'python -c "import ssl; print(ssl.OPENSSL_VERSION)"' to verify OpenSSL version and 'python -c "import ssl; ctx = ssl.create_default_context(); print(ctx.verify_mode)"' to check SSL context settings. Monitor network traffic for connections using affected certificates.

Useful 0 Not Useful 0

Impact Analysis

If you use Python applications that rely on SSL/TLS for secure connections, this vulnerability could allow attackers to intercept or manipulate your communications if they have compromised certificates. Systems not updated with the latest Python versions may still trust these certificates, posing risks until software or trust stores are updated.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Python to a patched version (3.9 through 3.16) that includes the denylist. Ensure your system trust stores are updated to distrust the compromised eMudhra certificates. For systems unable to update, manually distrust the affected roots using OS-specific methods.

Useful 0 Not Useful 0