Distrust compromised intermediate certificates in ssl module

Summary

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

Remediation

1. Inventory every Python Software Foundation CPython deployment, including staging.
2. Upgrade Python Software Foundation CPython to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/python/cpython/pull/160042
• Patchhttps://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d
• Patchhttps://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd
• Patchhttps://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93
• Patchhttps://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6
• Patchhttps://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5
• Patchhttps://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b
• Patchhttps://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90
• Patchhttps://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8
• Patchhttps://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78
• Patchhttps://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370
• Patchhttps://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e