# \#security **URL:** https://discuss.python.org/tag/security/45.md [Latest](https://discuss.python.org/latest.md) · [Categories](https://discuss.python.org/categories.md) · [Tags](https://discuss.python.org/tags.md) --- ## [Information for Python users regarding eMudhra / emSign CA certificate security incident](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576)
**Author:** [@sethmlarson](https://discuss.python.org/u/sethmlarson)\ **Replies:** 41\ **Last updated:** [October 23, 2026, 5:57am UTC](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 "2026-10-23T05:57:40Z")
A security incident affecting eMudhra intermediate certificates has required removing the emSign root CA certificate from CA bundles such as “certifi”. It’s important to immediately upgrade the software packages below to… --- ## [Adding \`security\` as a well-known URL label and \`\[project.security\]\` table to pyproject.toml](https://discuss.python.org/t/adding-security-as-a-well-known-url-label-and-project-security-table-to-pyproject-toml/108826)
**Author:** [@BHUVANSH855](https://discuss.python.org/u/BHUVANSH855)\ **Replies:** 19\ **Last updated:** [September 6, 2026, 9:32am UTC](https://discuss.python.org/t/adding-security-as-a-well-known-url-label-and-project-security-table-to-pyproject-toml/108826 "2026-09-06T09:32:24Z")
Hi all, I’ve been contributing to CPython’s security tooling and Python docs translation, and I keep running into the same practical gap: there is no standard, machine-readable way for a Python package to declare its se… --- ## [Protecting component package names on PyPI before a project is ready to publish](https://discuss.python.org/t/protecting-component-package-names-on-pypi-before-a-project-is-ready-to-publish/108453)
**Author:** [@Fezzik](https://discuss.python.org/u/Fezzik)\ **Replies:** 11\ **Last updated:** [August 11, 2026, 3:20pm UTC](https://discuss.python.org/t/protecting-component-package-names-on-pypi-before-a-project-is-ready-to-publish/108453 "2026-08-11T15:20:24Z")
I’m building an open source game engine in pure Python, with Vulkan desktop rendering and WebGPU export so games run in the browser. The site and demos are up and I’m putting together the infrastructure for early dev p… --- ## [Moving packaging security coordination out of the PSRT](https://discuss.python.org/t/moving-packaging-security-coordination-out-of-the-psrt/107483)
**Author:** [@Stanfromireland](https://discuss.python.org/u/Stanfromireland)\ **Replies:** 10\ **Last updated:** [May 26, 2026, 7:09am UTC](https://discuss.python.org/t/moving-packaging-security-coordination-out-of-the-psrt/107483 "2026-05-26T07:09:57Z")
This discussion recently came up on the Packaging Discord. I think we need a new coordination path for security disclosures affecting Python packaging tools. Currently, the Python Security Response Team (PSRT) is respons… --- ## [PyPi plans for 2026?](https://discuss.python.org/t/pypi-plans-for-2026/107395)
**Author:** [@pygaiwan](https://discuss.python.org/u/pygaiwan)\ **Replies:** 0\ **Last updated:** [May 15, 2026, 4:19pm UTC](https://discuss.python.org/t/pypi-plans-for-2026/107395 "2026-05-15T16:19:43Z")
Hello everyone, I am preparing a talk at pycon italy (Trust, but Verify: Reviewing Interviewer Python Code for Hidden Malware | PyCon Italia) around how to analyze and recognize potentially malicious packages in the con… --- ## [Slopsquatting for the common good](https://discuss.python.org/t/slopsquatting-for-the-common-good/107226)
**Author:** [@phildini](https://discuss.python.org/u/phildini)\ **Replies:** 5\ **Last updated:** [May 7, 2026, 7:29pm UTC](https://discuss.python.org/t/slopsquatting-for-the-common-good/107226 "2026-05-07T19:29:24Z")
Hello! This seems extremely timely with the conversation around typosquatting. A security research friend and myself are worried about the security risks in the mcp-{noun} package space, and decided to something about it… --- ## [Announcement: 2FA now required for PyPI](https://discuss.python.org/t/announcement-2fa-now-required-for-pypi/42251)
**Author:** [@miketheman](https://discuss.python.org/u/miketheman)\ **Replies:** 31\ **Last updated:** [March 26, 2026, 8:47pm UTC](https://discuss.python.org/t/announcement-2fa-now-required-for-pypi/42251 "2026-03-26T20:47:33Z")
Hello, As previously announced, PyPI now requires a form of Two-factor Authentication (2FA) for all users. Today’s blog post contains more details. Thank you for your continued efforts to make PyPI more secure for eve… --- ## [Python 3.13.x SSL security changes](https://discuss.python.org/t/python-3-13-x-ssl-security-changes/91266)
**Author:** [@ricsonchua](https://discuss.python.org/u/ricsonchua)\ **Replies:** 15\ **Last updated:** [February 23, 2026, 4:07pm UTC](https://discuss.python.org/t/python-3-13-x-ssl-security-changes/91266 "2026-02-23T16:07:49Z")
My organization currently uses Zscaler for security and VPN. On top of that I have no admin rights to my Windows machine. I have tried a whole host of solutions which led me to pip-system-certs is this StackOverflow que… --- ## [Regularly disabling unused commit access to the cpython repo](https://discuss.python.org/t/regularly-disabling-unused-commit-access-to-the-cpython-repo/105010)
**Author:** [@gpshead](https://discuss.python.org/u/gpshead)\ **Replies:** 8\ **Last updated:** [November 25, 2025, 5:04pm UTC](https://discuss.python.org/t/regularly-disabling-unused-commit-access-to-the-cpython-repo/105010 "2025-11-25T17:04:33Z")
Howdy committers - The Python Steering Council (PSC) has had an open issue based on discussions last year to improve our project’s security posture. We’re going to move forward with disabling GitHub commit privileges fo… --- ## [Attacks on dictionaries when the keys are integers](https://discuss.python.org/t/attacks-on-dictionaries-when-the-keys-are-integers/102812)
**Author:** [@vxgmichel](https://discuss.python.org/u/vxgmichel)\ **Replies:** 23\ **Last updated:** [August 27, 2025, 9:00pm UTC](https://discuss.python.org/t/attacks-on-dictionaries-when-the-keys-are-integers/102812 "2025-08-27T21:00:29Z")
I was recently surprised to hear about the use of anti-hash-table in codeforces: https://codeforces.com/blog/entry/101817 For some context, “hacking” in codeforces is a specific part of the competition. The idea is to … --- ## [Add .github repository with a SECURITY.md file?](https://discuss.python.org/t/add-github-repository-with-a-security-md-file/102604)
**Author:** [@jcrben](https://discuss.python.org/u/jcrben)\ **Replies:** 4\ **Last updated:** [August 17, 2025, 12:25am UTC](https://discuss.python.org/t/add-github-repository-with-a-security-md-file/102604 "2025-08-17T00:25:11Z")
The pypa Github org repositories don’t always have a SECURITY.md which makes it easy for users to understand how security is handled. For example I glanced at Security Overview · pypa/build · GitHub (image below) Githu… --- ## [mTLS connection with Strings/Buffers](https://discuss.python.org/t/mtls-connection-with-strings-buffers/96463)
**Author:** [@robbishop](https://discuss.python.org/u/robbishop)\ **Replies:** 5\ **Last updated:** [June 24, 2025, 8:14am UTC](https://discuss.python.org/t/mtls-connection-with-strings-buffers/96463 "2025-06-24T08:14:19Z")
I have an issue with setting up an mTLS connection using in memory strings/buffers containing the client cert/key. I’ve checked out urllib, urllib3, requests and httpx and they all seem to require passing the cert/key as… --- ## [Reviews requested for email security fixes](https://discuss.python.org/t/reviews-requested-for-email-security-fixes/73094)
**Author:** [@medmunds](https://discuss.python.org/u/medmunds)\ **Replies:** 0\ **Last updated:** [December 2, 2024, 7:34pm UTC](https://discuss.python.org/t/reviews-requested-for-email-security-fixes/73094 "2024-12-02T19:34:00Z")
Would someone familiar with the email package be able to review these two security-related PRs? gh-80222: Fix email address header folding with long quoted-string by medmunds · Pull Request #122753 · python/cpython · G… --- ## [The Python Software Foundation has been authorized by the CVE Program as a CVE Numbering Authority (CNA)](https://discuss.python.org/t/the-python-software-foundation-has-been-authorized-by-the-cve-program-as-a-cve-numbering-authority-cna/32561)
**Author:** [@sethmlarson](https://discuss.python.org/u/sethmlarson)\ **Replies:** 6\ **Last updated:** [November 20, 2024, 4:46pm UTC](https://discuss.python.org/t/the-python-software-foundation-has-been-authorized-by-the-cve-program-as-a-cve-numbering-authority-cna/32561 "2024-11-20T16:46:45Z")
Towards the goal of a more secure and safe Python ecosystem, the Python Software Foundation has been authorized by the CVE Program as a CVE Numbering Authority (CNA)! :partying\_face: Being a CNA means the PSF can improv… --- ## [Securely parsing XML with expat 2.6.0 or later](https://discuss.python.org/t/securely-parsing-xml-with-expat-2-6-0-or-later/59853)
**Author:** [@annikasno](https://discuss.python.org/u/annikasno)\ **Replies:** 0\ **Last updated:** [August 3, 2024, 5:00am UTC](https://discuss.python.org/t/securely-parsing-xml-with-expat-2-6-0-or-later/59853 "2024-08-03T05:00:24Z")
The Python official documentation (3.12) recommends defusedxml for securely parsing XML, but also states that all standard library modules with the exception of xmlrpc are safe so long as expat 2.6.0 or later is used. I… --- ## [Typosquatting, dependency confusion, supply chain attack, call it as you wish](https://discuss.python.org/t/typosquatting-dependency-confusion-supply-chain-attack-call-it-as-you-wish/52615)
**Author:** [@Tansu.KAYRAK](https://discuss.python.org/u/Tansu.KAYRAK)\ **Replies:** 12\ **Last updated:** [May 6, 2024, 9:59pm UTC](https://discuss.python.org/t/typosquatting-dependency-confusion-supply-chain-attack-call-it-as-you-wish/52615 "2024-05-06T21:59:43Z")
Firstly, I am quite a beginner with python and to this day I am still confused by the fact that python scripts provided on the web come along import statements like “import foo” where “foo” is a dependency whose origin n… --- ## [Pip must notify people that they have been compromised by a malicious package](https://discuss.python.org/t/pip-must-notify-people-that-they-have-been-compromised-by-a-malicious-package/41203)
**Author:** [@rook](https://discuss.python.org/u/rook)\ **Replies:** 19\ **Last updated:** [May 1, 2024, 4:33pm UTC](https://discuss.python.org/t/pip-must-notify-people-that-they-have-been-compromised-by-a-malicious-package/41203 "2024-05-01T16:33:49Z")
When a malicious package is identified, I strongly believe we have a moral obligation to notify people that they have been hacked. I work in the industry, and cleaning up from a breach is never fun - but one thing is uni… --- ## [Trying to understand security backport policy](https://discuss.python.org/t/trying-to-understand-security-backport-policy/50635)
**Author:** [@mgorny](https://discuss.python.org/u/mgorny)\ **Replies:** 7\ **Last updated:** [April 25, 2024, 1:48pm UTC](https://discuss.python.org/t/trying-to-understand-security-backport-policy/50635 "2024-04-25T13:48:36Z")
Hi, I’m trying to understand the policy used to determine to which prior branches are particular security fixes backported. Let me explain based on a few recent examples. Right now, branches down to 3.8 are still secur… --- ## [Pathway to requiring OpenSSL 3 or newer in CPython?](https://discuss.python.org/t/pathway-to-requiring-openssl-3-or-newer-in-cpython/46055)
**Author:** [@woodruffw](https://discuss.python.org/u/woodruffw)\ **Replies:** 10\ **Last updated:** [April 17, 2024, 8:46pm UTC](https://discuss.python.org/t/pathway-to-requiring-openssl-3-or-newer-in-cpython/46055 "2024-04-17T20:46:23Z")
Hi all, I’m opening this up for discussion – originally I was thinking to propose a pre-PEP here, but I realized that I don’t know enough about LTS distros to confidently state that OpenSSL 3 is widely adopted … --- ## [CPython, PyPI, and many Python packages are not affected by the backdoor of xz](https://discuss.python.org/t/cpython-pypi-and-many-python-packages-are-not-affected-by-the-backdoor-of-xz/49873)
**Author:** [@sethmlarson](https://discuss.python.org/u/sethmlarson)\ **Replies:** 6\ **Last updated:** [April 11, 2024, 5:17pm UTC](https://discuss.python.org/t/cpython-pypi-and-many-python-packages-are-not-affected-by-the-backdoor-of-xz/49873 "2024-04-11T17:17:38Z")
Note that this is actively unfolding event so we might not have all the facts straight right now, if anything changes this thread will be updated appropriately. It was posted on Openwall earlier today that the xz-util… --- ## [PyPI Malware Observation Report Outcomes - Private Preview](https://discuss.python.org/t/pypi-malware-observation-report-outcomes-private-preview/49060)
**Author:** [@miketheman](https://discuss.python.org/u/miketheman)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 7:37pm UTC](https://discuss.python.org/t/pypi-malware-observation-report-outcomes-private-preview/49060 "2024-03-20T19:37:45Z")
Hello! I recently shared a bit about how malware reporting for PyPI projects has evolved. A question folks have often asked about is “what happens after our report is submitted?” as well as “can we learn about other p… --- ## [Create and distribute Software Bill-of-Materials (SBOM) for Python artifacts](https://discuss.python.org/t/create-and-distribute-software-bill-of-materials-sbom-for-python-artifacts/39293)
**Author:** [@sethmlarson](https://discuss.python.org/u/sethmlarson)\ **Replies:** 29\ **Last updated:** [February 7, 2024, 2:10pm UTC](https://discuss.python.org/t/create-and-distribute-software-bill-of-materials-sbom-for-python-artifacts/39293 "2024-02-07T14:10:13Z")
I’m proposing creating and distributing Software Bill of Materials documents alongside Python releases. This is not a change to CPython itself, however would have an impact on core developers that are updating these depe… --- ## [Python maillibs don't verify server certificates by default, which is documented behavior, but several open source projects failed to do this right and I like to see this fixed](https://discuss.python.org/t/python-maillibs-dont-verify-server-certificates-by-default-which-is-documented-behavior-but-several-open-source-projects-failed-to-do-this-right-and-i-like-to-see-this-fixed/42313)
**Author:** [@nitram2342](https://discuss.python.org/u/nitram2342)\ **Replies:** 13\ **Last updated:** [February 5, 2024, 2:25pm UTC](https://discuss.python.org/t/python-maillibs-dont-verify-server-certificates-by-default-which-is-documented-behavior-but-several-open-source-projects-failed-to-do-this-right-and-i-like-to-see-this-fixed/42313 "2024-02-05T14:25:53Z")
The Python mail libraries such as smtplib, imaplib and pop3lib do not verify server certificates per default, when a client based on these mail libraries connects to a server via TLS. Any server certificate is accepted p… --- ## [How to hide or remove sensitive data from getting exposed in memory dump?](https://discuss.python.org/t/how-to-hide-or-remove-sensitive-data-from-getting-exposed-in-memory-dump/44526)
**Author:** [@madhavs](https://discuss.python.org/u/madhavs)\ **Replies:** 2\ **Last updated:** [January 30, 2024, 8:52am UTC](https://discuss.python.org/t/how-to-hide-or-remove-sensitive-data-from-getting-exposed-in-memory-dump/44526 "2024-01-30T08:52:54Z")
In windows platform, python application data is getting exposed in the memory dump. Memory dump is taken by using process hacker tool. def f1(self): # some code id = "\" ret… --- ## [Announcement: 2FA Requirement for PyPI 2024-01-01](https://discuss.python.org/t/announcement-2fa-requirement-for-pypi-2024-01-01/40906)
**Author:** [@miketheman](https://discuss.python.org/u/miketheman)\ **Replies:** 0\ **Last updated:** [December 11, 2023, 9:38pm UTC](https://discuss.python.org/t/announcement-2fa-requirement-for-pypi-2024-01-01/40906 "2023-12-11T21:38:45Z")
Hello, PyPI has been on the path of making Two-factor Authentication a reality, which began in 2019. Read more about some of the steps taken in recent months on the PyPI Blog: Securing PyPI accounts via Two-Factor Au… --- ## [\`ssl\`: changing the default \`SSLContext.verify\_flags\`?](https://discuss.python.org/t/ssl-changing-the-default-sslcontext-verify-flags/30230)
**Author:** [@woodruffw](https://discuss.python.org/u/woodruffw)\ **Replies:** 16\ **Last updated:** [November 28, 2023, 8:46pm UTC](https://discuss.python.org/t/ssl-changing-the-default-sslcontext-verify-flags/30230 "2023-11-28T20:46:13Z")
At the moment (CPython 3.11), the default SSLContext.verify\_flags is set to just VERIFY\_X509\_TRUSTED\_FIRST: \>\>\> import ssl \>\>\> ssl.create\_default\_context().verify\_flags \ I… --- ## [How to word a warning about security uses in \`urllib.parse\` docs](https://discuss.python.org/t/how-to-word-a-warning-about-security-uses-in-urllib-parse-docs/26399)
**Author:** [@gpshead](https://discuss.python.org/u/gpshead)\ **Replies:** 15\ **Last updated:** [May 3, 2023, 10:10pm UTC](https://discuss.python.org/t/how-to-word-a-warning-about-security-uses-in-urllib-parse-docs/26399 "2023-05-03T22:10:49Z")
As part of this PR for Issue #102153 I’m pondering adding the text in diff-form appended below to our urllib.parse docs. I’m a little concerned this wording could leave people going “well thanks, now what am I supposed t… --- ## [Using SourceRank score to warn or limit packages](https://discuss.python.org/t/using-sourcerank-score-to-warn-or-limit-packages/26271)
**Author:** [@Heteroskedastic](https://discuss.python.org/u/Heteroskedastic)\ **Replies:** 17\ **Last updated:** [April 30, 2023, 7:09pm UTC](https://discuss.python.org/t/using-sourcerank-score-to-warn-or-limit-packages/26271 "2023-04-30T19:09:32Z")
Feedback… I have been thinking about solutions to the malicious package problem. I am wondering if there are option in the pip configuration to define checks. A simple few simple examples. Warn if a package with a So… --- ## [Sprint recording: Dustin Ingram on Open Source Security for CPython](https://discuss.python.org/t/sprint-recording-dustin-ingram-on-open-source-security-for-cpython/20152)
**Author:** [@gpshead](https://discuss.python.org/u/gpshead)\ **Replies:** 3\ **Last updated:** [October 20, 2022, 7:59pm UTC](https://discuss.python.org/t/sprint-recording-dustin-ingram-on-open-source-security-for-cpython/20152 "2022-10-20T19:59:36Z")