From 741f4c57d59ba8a42d169d1579b3962d1557c9a9 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Sat, 24 Oct 2026 12:56:25 +0200 Subject: [PATCH] gh-160040: Add ssl eMudhra distrust entry to whatsnew [3.15] Signed-off-by: Christian Heimes --- Doc/whatsnew/3.15.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Doc/whatsnew/3.15.rst b/Doc/whatsnew/3.15.rst index 6213899892a5d39..91bd562daf25b13 100644 --- a/Doc/whatsnew/3.15.rst +++ b/Doc/whatsnew/3.15.rst @@ -2907,3 +2907,18 @@ that may require changes to your code. Use warning filters to silence them or additional :meth:`!assertWarns*` to catch and check them. (Contributed by Serhiy Storchaka in :gh:`143231`.) + + +Notable changes in 3.15.2 +========================= + +ssl +--- + +* The :mod:`ssl` module now rejects TLS certificate chains that contain one + of a set of compromised eMudhra intermediate CA certificates. The affected + certificates are identified by their public key, so cross-signed copies that + reuse the same key are blocked as well. It is a defense-in-depth backstop + that applies even when an application supplies its own root CA bundle, and + regardless of whether the platform trust store has removed trust. + (Contributed by Christian Heimes in :gh:`160040` for :cve:`2026-115557`.)