The eMudhra CA compromise: What Python developers need to update

Python developers need to update their packaging tools after the eMudhra certificate authority compromise. Upstream pip and uv carry their own certificate stores.

Certificate authorities help HTTPS clients verify that they are connecting to the intended server. Researchers discovered that the private keys for eight eMudhra intermediate CA certificates were recoverable from public information. An attacker who intercepts a connection could use those keys to impersonate a service such as a package repository. Read the incident report.

Check which certificate stores your tools use

Browsers received protections through their certificate revocation systems. Many other HTTPS clients require software updates to stop trusting the compromised certificates.

Upstream pip includes its own copy of certifi, the package containing trusted CA certificates. Updating your application’s certifi dependency does not replace pip’s bundled copy. pip uses system certificates alongside its bundle, so an operating system update alone is insufficient. For distribution-managed pip, follow the distribution’s security updates. Read pip’s certificate documentation.

uv uses a separate bundled certificate store by default, which also required an update. Read uv’s security advisory.

Update each environment and build image

Use these versions or newer, following the Python security guidance and uv’s follow-up security release:

For pip, start with the official guidance’s hash-verified installation command: it checks the downloaded file against an expected checksum and rejects a mismatched file.

Update pip in each existing virtual environmentAn isolated folder where Python installs packages for one project, keeping them separate from other projects and your system Python. Learn more → that contains it. Update certifi wherever applications depend on it, including dependency pins and lockfilesA file that records the exact version of every installed package, so everyone working on the project gets identical installs. that would otherwise restore an older copy.

Before using uv to download its own update, select a patched system certificate store as the Python guidance explains. Then follow the installation-specific upgrade instructions.

Update uv-managed Python builds separately. Existing environments still need their pip updated, as uv’s release notes explain.

For containers and CI, update pinned tools and dependencies, fetch patched base images, and rebuild with layer caching disabled. Redeploy the rebuilt images so running workloads receive the fixes. The Python advisory also covers affected tools including conda, pixi, and sigstore.