GHSA-hq85-5cpj-mr62
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v4.0)
- Affected packages
- uv (pip) < 0.13.4, fixed in 0.13.4 · GHSA-hq85-5cpj-mr62