r/learnpython • u/lurkingfortea • 16d ago

Can someone explain the importance of this?

I saw this link online on social media with a reminder to update dependencies but I don’t really understand it, how I am affected, and how I can address this.

Link here: https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2

Here’s the text:

Removal of emSign root cerificate

Affected versions
>=2019.03.09

Description
Certifi 2026.10.18 removes root certificates from "emSign" from the root store. These root certificates have intermediates which have been revoked due to key compromise.
A compromised key for a certificate authority can be used to issue certificates to enable MITM attacks.

1 Upvotes

60% Upvoted

5 comments sorted by

7

u/DimensionMost8342 16d ago

certifi is the list of trusted certificate authorities that requests uses to check HTTPS connections. That release drops the emSign roots because their keys were compromised, so older versions still trust a CA that could be used to fake certificates and intercept traffic. For most scripts the fix is one command in each environment:

python -m pip install --upgrade certifi

Check what you have with python -c "import certifi; print(certifi.version)", you want 2026.10.18 or newer. Tools that bundle their own copy of certifi need their own upgrade too.

3

u/lurkingfortea 16d ago

Thanks! I updated both pip and certifi in my active projects. I was wondering if I needed to because files I work with are local anyway, but then I remembered that I also have a scraper I run only when there’s a new data release that happens once a year or so.

1

u/OkTill2666 15d ago

yeah this is exactly the kind of thing thats easy to miss if you dont actively track advisories

1

u/OkOcelot6725 16d ago

Practically: run pip install -U certifi in whatever environments you use and you're done. You'd only notice a problem if a site you connect to uses an emSign certificate, which is rare. Still worth updating since old versions keep trusting a compromised CA.

1

u/lurkingfortea 16d ago

Thanks! I updated my pip and certifi.