GHSA-hq85-5cpj-mr62: 
Python vulnerability analysis and mitigation

Summary

This is a widespread incident that affects the entire open source ecosystem. If you use any software that depends on vendored CA bundles via packages like certifi or webpki-root-certs, you MUST upgrade it. uv is not the only impacted package. You MUST evaluate your other packages. Intermediate certificates issued by the emSign ECC Root CA - G3 root CA are considered compromised. A compromised CA can be used to impersonate websites, circumventing the integrity and authenticity controls of HTTPS. uv 0.13.4 removes this root CA from its vendored CA bundle (following webpki-root-certs). Users should upgrade to 0.13.4 immediately, or otherwise confirm that their usage either uses the system CA certificates (--system-certs) or custom certificates (SSL_CERT_FILE or SSL_CERT_DIR) and that neither of those contain the compromised intermediates or their roots.

Details

The emSign ECC Root CA - G3 root CA issued intermediate CA certificates whose keys are compromised. Connections that chain through those intermediates should be considered insecure. See https://github.com/rustls/webpki-roots/releases/tag/v%2F1.0.10 and https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2 for additional context. Users are affected if they use uv's bundled CA certificates, which are used by default. Users who use system certificates instead should consult their system's certificate store to ensure that the root and/or its compromised intermediates are already distrusted by their operating system. Users who use a custom CA file or directory should confirm that their custom bundle(s) do not contain the compromised intermediates and/or their roots.

Proof of concept

See:

• https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
• https://emudhra.we-have-a-problem.com/
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ

Impact

A compromised key for a certificate authority can be used to issue certificates to enable MITM attacks.