*** This bug is a security vulnerability ***
Public security bug reported:
The python3.14 package in The Resolute Raccoon does not include the upstream
security
fixes released in Python 3.14.9 and 3.14.10 for the compromised eMudhra CA keys:
- 3.14.10: CVE-2026-115557 / gh-160040 ("ssl: distrust compromised eMudhra
intermediate
CA keys")
Issue: https://github.com/python/cpython/issues/160040
3.14 backport: https://github.com/python/cpython/pull/160569
- 3.14.9: gh-159894 ("Bump the version of pip bundled in ensurepip to version
26.2.2")
Issue: https://github.com/python/cpython/issues/159894
Upstream release:
https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/
Affected:
- The Resolute Raccoon: 3.14.4-1ubuntu0.2 (security, updates)
- Stonking Stingray is also affected (3.14.8-1ubuntu1)
Already fixed in the development series (Tenacious T-Rex: 3.14.10-1).
From the upstream issue: "Until the roots are gone, Python still completes
handshakes
through a known-bad key."
Please consider backporting both changes to python3.14 in The Resolute Raccoon
(and Stonking Stingray).
** Affects: python3.14 (Ubuntu)
Importance: Undecided
Status: New
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173056
Title:
python3.14 (Resolute): please backport the eMudhra CA fixes from
upstream 3.14.9/3.14.10 (gh-160040, ensurepip pip 26.2.2)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python3.14/+bug/2173056/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
