From 43cf1ba1b803f52600783d3a39a446a7940d7ef7 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Sat, 24 Oct 2026 12:35:50 +0200 Subject: [PATCH] gh-160040: Add ssl eMudhra distrust entry to whatsnew Signed-off-by: Christian Heimes --- Doc/whatsnew/3.16.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Doc/whatsnew/3.16.rst b/Doc/whatsnew/3.16.rst index 64112bd8bd4ddd..e342aa71c7924e 100644 --- a/Doc/whatsnew/3.16.rst +++ b/Doc/whatsnew/3.16.rst @@ -721,6 +721,14 @@ ssl the module. (Contributed by Serhiy Storchaka in :gh:`157513`.) +* The :mod:`ssl` module now rejects TLS certificate chains that contain one + of a set of compromised eMudhra intermediate CA certificates. The affected + certificates are identified by their public key, so cross-signed copies that + reuse the same key are blocked as well. It is a defense-in-depth backstop + that applies even when an application supplies its own root CA bundle, and + regardless of whether the platform trust store has removed trust. + (Contributed by Christian Heimes in :gh:`160040` for :cve:`2026-115557`.) + symtable --------