Security Advisory: Signatures python SDK

Security Advisory: Signatures python SDK

The Signatures Python SDK has a transitive dependency on certifi. certifi versions before 2026.10.19 trust the emSign ECC Root CA - G3 root certificate, and the compromised intermediate eMudhra CAs that chain to it (GHSA-6q48-6c7w-9gw2 (https://github.com/advisories/GHSA-6q48-6c7w-9gw2)).

The SDK uses the certifi bundle to verify TLS connections to the Signatures API. An on-path attacker holding one of the compromised keys could intercept or modify that traffic.

Neither the SDK nor its dependencies place an upper bound on certifi, so no new SDK version is needed. Upgrade certifi to 2026.10.19 or later in your environment or lockfile.