certifi: Compromised emSign Intermediate CA Keys Enable TLS MITM (CVE-209)

Vulnerability Overview Vulnerability Name: certifi bundles emSign root CAs with compromised intermediate CA keys Vulnerability Type: Compromised Intermediate CA Keys Release Date: 3 days ago Severity: Critical (CVSS 3.1: 9.1) Scope of Impact Affected Versions: 2019.03.09 to 2026.10.18 Affected Package: certifi Description: Versions of certifi prior to 2026.10.18 included the root certificate for emSign Root CA - G3 in their bundled CA store. Eight ekudhura intermediate CA certificates chain to this root certificate, and the keys for these intermediate CAs have been compromised. Attackers can use these compromised keys to generate seemingly valid certificates for any domain. If an attacker also controls a gTLD, they can intercept TLS traffic destined for certifi clients. Remediation Fixed Version: 2026.10.18 Fix Details: The emSign root certificate was removed from certifi. Version 2026.10.19 restored the unaffected emSign root certificates. Recommendation: Upgrade to version 2026.10.19 or higher and rebuild containers containing certifi. Additional Information CVE ID: CVE-209 EPSS Score: None Source Code: certifi/python-certifi References https://ekudhara.emsign.com/ https://ekudhara.emsign.com/Information-for-python-users-regarding-emudhara-emSign-CA-certifi-security-incident105676 https://venmo-thr-ve-have-a-problem.com Related Activities User Activities: - added to last week. - to the Ghidra Advisory Database last week. - last week. - 3 days ago. Vulnerability Metrics Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: None - User Interaction: None Vulnerability Impact Metrics: - Confidentiality: High - Integrity: High - Availability: None Subsequent Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Weakness CWE-209 Additional Information CVSS Score: 9.1 EPSS Score: None CVE ID: CVE-209 OGA ID: GHSA-fqg8-6c7h-9p6z Source Code: certifi/python-certifi Contribution Contribute: Submit suggestions to improve this vulnerability report.

Goal Reached Thanks to every supporter — we hit 100%!

certifi: Compromised emSign Intermediate CA Keys Enable TLS MITM (CVE-209)

More from this source