Security Digest · Critical advisory (no CVE assigned)
GHSA-5xjx-3w67-w9x9: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution.
CVSS 9.3 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
grep -rn 'uses: <owner>/<action>' .github/workflows. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| GitHub Actions | pypa/gh-action-pypi-publish | <= 1.14.2 | 1.14.3 |
Details
Summary
The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them.
[pypi-publish]: https://github.com/marketplace/actions/pypi-publish
Details
The certifi-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations.
Related
The external compromise is being tracked at https://emudhra.we-have-a-problem.com
CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Sources and references
- GitHub Advisory GHSA-5xjx-3w67-w9x9 github.com
- github.com github.com
Critical GitHub Actions advisories · Today’s Security Digest