eMudhra CA Compromise Prompts pip and uv Trust Updates

Compromised eMudhra intermediate CA keys can let someone who intercepts a connection impersonate an HTTPS package index to a Python downloader that still trusts the affected chain. StepSecurity tested fourteen published certificate chains: an old certifi bundle accepted seven, while corrected certifi and pip bundles rejected all fourteen. StepSecurity says whether attackers exploited this weakness against non-browser clients remains unknown. Use the test result to scope outdated client trust; investigate suspicious downloaded artifacts separately. Browser blocks leave pip’s and uv’s independent roots to update.

Inventory the interpreters and downloaders in virtual environments, self-hosted CI runners, build stages and application images. Run python -m pip --version, python -m pip show certifi and python -c "import ensurepip; print(ensurepip.version())" with the interpreter that creates new environments. Update upstream pip to 26.2.2 or later, certifi to 2026.10.19 or later and uv’s bundled-root installations to 0.13.4 or later. Pip 26.2.2 needs Python 3.10 or newer; older interpreters need an upgrade or distributor fix. Check PIP_CERT, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, SSL_CERT_FILE and SSL_CERT_DIR for custom trust, and replace affected CI base images and pinned build layers.

Test the workload’s selected verifier against the affected chains and confirm rejection, including alternate paths. Then confirm authorized package downloads still work through the replacement trust chain. Treat unexpected artifacts or processes as an investigation lead distinct from an outdated CA bundle.