From 5bed6acbc623b2fda21550686db64cc65f13b7de Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Sat, 24 Oct 2026 12:56:24 +0200 Subject: [PATCH] gh-160040: Add ssl eMudhra distrust entry to whatsnew [3.14] Signed-off-by: Christian Heimes --- Doc/whatsnew/3.14.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Doc/whatsnew/3.14.rst b/Doc/whatsnew/3.14.rst index db5ed81df1e07f..dc8da16645686c 100644 --- a/Doc/whatsnew/3.14.rst +++ b/Doc/whatsnew/3.14.rst @@ -3511,3 +3511,18 @@ gc `__ of significant memory pressure in production environments. See :ref:`whatsnew314-incremental-gc` for details. + + +Notable changes in 3.14.10 +========================== + +ssl +--- + +* The :mod:`ssl` module now rejects TLS certificate chains that contain one + of a set of compromised eMudhra intermediate CA certificates. The affected + certificates are identified by their public key, so cross-signed copies that + reuse the same key are blocked as well. It is a defense-in-depth backstop + that applies even when an application supplies its own root CA bundle, and + regardless of whether the platform trust store has removed trust. + (Contributed by Christian Heimes in :gh:`160040` for :cve:`2026-115557`.)