From 356626e7e363da2175a539a0c855144c8ed52108 Mon Sep 17 00:00:00 2001 From: cb-alish Date: Tue, 27 Oct 2026 19:56:44 +0530 Subject: [PATCH] security: remove compromised AAA Certificate Services root from CA bundle Remove the AAA Certificate Services (Comodo CA Limited) root certificate from the bundled CA store. Six of the leaked eMudhra intermediate certificate keys chain back to this root. Browsers and OSes have revoked trust since Oct 17-22 2026, but the SDK's bundled cert store was still trusting it. Chargebee uses the Amazon/Starfield certificate chain, which is unaffected. Bumps version to 3.30.0. Co-authored-by: Cursor --- CHANGELOG.md | 5 +++++ VERSION | 2 +- chargebee/ssl/ca-certs.crt | 24 ------------------------ chargebee/version.py | 2 +- 4 files changed, 7 insertions(+), 26 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 52f32afa..802cb239 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,8 @@ +### v3.30.0 (2026-10-27) +* * * +#### Security Fix: +- Removed the **AAA Certificate Services** root certificate from the bundled CA certificate store (`chargebee/ssl/ca-certs.crt`). This root is linked to six compromised eMudhra intermediate certificates whose private keys were publicly leaked on 2026-10-20. Browsers and operating systems have already revoked trust in this root, but the SDK's bundled certificate store was still trusting it, leaving applications vulnerable to man-in-the-middle attacks. + ### v3.29.0 (2026-09-24) * * * ### New Resources: diff --git a/VERSION b/VERSION index c7c97732..1cfe511a 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.29.0 +3.30.0 diff --git a/chargebee/ssl/ca-certs.crt b/chargebee/ssl/ca-certs.crt index 8e34b202..e052c41d 100644 --- a/chargebee/ssl/ca-certs.crt +++ b/chargebee/ssl/ca-certs.crt @@ -815,30 +815,6 @@ GrZgFCdsMneMvLJymM/NzD+5yCRCFNZX/OYmQ6kd5YCQzgNUKD73P9P4Te1qCjqTE5s7FCMTY5w/ qFlnGNu8cN2bsWntgM6JQEhqDjXKKWYVIZQs6GAqm4VKQPNriiTsBhYscw== -----END CERTIFICATE----- -Comodo AAA Services root -======================== ------BEGIN CERTIFICATE----- -MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwS -R3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0Eg -TGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAw -MFoXDTI4MTIzMTIzNTk1OVowezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hl -c3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV -BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC -ggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQuaBtDFcCLNSS1UY8y2bmhG -C1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe3M/vg4aijJRPn2jymJBGhCfHdr/jzDUs -i14HZGWCwEiwqJH5YZ92IFCokcdmtet4YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszW -Y19zjNoFmag4qMsXeDZRrOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjH -Ypy+g8cmez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQUoBEK -Iz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wewYDVR0f -BHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNl -cy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2Vz -LmNybDANBgkqhkiG9w0BAQUFAAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm -7l3sAg9g1o1QGE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz -Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2G9w84FoVxp7Z -8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsil2D4kF501KKaU73yqWjgom7C -12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== ------END CERTIFICATE----- - Comodo Secure Services root =========================== -----BEGIN CERTIFICATE----- diff --git a/chargebee/version.py b/chargebee/version.py index 04b8528f..7d897b8d 100644 --- a/chargebee/version.py +++ b/chargebee/version.py @@ -1 +1 @@ -VERSION = "3.29.0" +VERSION = "3.30.0"