[AethersDev]

Updates

• Affected products
• Description
• References

Comments
GHSA-6q48-6c7w-9gw2 lists certifi >= 2019.03.09, < 2026.10.19 as affected, which matches the releases that bundle emSign ECC Root CA - G3. Releases before 2019.03.09 are also affected, through a second certification path.

Each of the eight compromised eMudhra intermediates also exists as a cross-certificate issued by AAA Certificate Services (Comodo AAA Services root) with the same key (listed in impacted-intermediates.json).

certifi bundled AAA Certificate Services until 2019.03.09. Sectigo revoked the cross-certificates on
2026-10-19, but Python's ssl module does not check revocation by default, so a bundle that contains AAA Certificate Services still accepts chains through them.

I verified the disclosure site's 14 test chains (chains.zip, SHA-256 7b949956955fc501a30f4d98d2f513d34c0bbbe92e29a968194c96e097ce2345) against every certifi release PyPI serves from 0.0.1 through 2026.10.19 (77 releases, each matched to PyPI's SHA-256), using OpenSSL 3 with the bundle as the only trust anchors (-CAfile -no-CApath -no-CAstore), purpose sslserver, and hostname verification:

0.0.1–2018.11.29 (33): no G3, AAA present -> emSign 0/7, AAA 7/7 accepted
2019.03.09–2025.1.31 (29): G3 and AAA present -> 7/7, 7/7
2025.4.26–2026.7.22 (13): G3 present, AAA gone -> 7/7, 0/7
2026.10.18, 2026.10.19 (2): neither -> 0/7, 0/7

Controls: the two roots alone accept all 14 chains; a wrong hostname is refused.
Both fixed releases reject all 14, so no code change is needed — only the range.

Reproduce one release (cacert.pem from certifi 2018.11.29, chain from chains.zip):

openssl verify -show_chain -CAfile cacert.pem -no-CApath -no-CAstore
-purpose sslserver
-verify_hostname dv-g3b-aaa-noct-emudhra.we-have-a-problem.com
-untrusted dv-g3b-aaa-noct-emudhra.we-have-a-problem.com.pem
dv-g3b-aaa-noct-emudhra.we-have-a-problem.com.pem

It prints OK on a chain ending at AAA Certificate Services.

Requested change: extend the affected range to < 2026.10.19 (patched 2026.10.19).
A scanner keying off the current lower bound does not flag pinned releases older than 2019.03.09; those drew 173,368 PyPI downloads over 2026-10-20..22 (bandersnatch mirror client excluded).

[github]

Hi there @alex! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory