GHSA-6q48-6c7w-9gw2

Affected versions of the `certifi` package are vulnerable to Insufficient Verification of Data Authenticity due to trusting a root certificate whose subordinate certificate authorities have compromised private keys. The bundle returned by `certifi.where()` includes `emSign ECC Root CA - G3`, which the TLS intermediates `EM DV TLS CA - G3B`, `EM OV TLS CA - G3B`, `EM EV TLS CA - G3B` and their `G3C` counterparts chain to through a cross-certificate; eMudhra has revoked these intermediates for key compromise, but a root bundle cannot express the revocation of an intermediate and Python's `ssl` module does not check revocation by default, so clients that load the bundle, such as `requests`, still accept certificates they issue. An attacker who holds one of the compromised keys and can intercept network traffic can issue a certificate for any hostname and impersonate HTTPS servers to clients that rely on `certifi`, reading and altering the traffic. Possession of the keys was demonstrated to the root programs, and how they were exposed has not been disclosed. As a workaround, remove the `emSign ECC Root CA - G3` certificate from the `cacert.pem` file that `certifi.where()` returns.