#1152852 pipenv ships pip version with compromised CA certificates

Package:
pipenv
Source:
pipenv
Submitter:
Maximilian Stein
Date:
2026-11-02 10:12:01 UTC
Severity:
normal
Tags:
#1152852#5
Date:
2026-11-02 09:16:55 UTC
From:
To:
Dear Maintainer,

I noticed that pipenv is indirectly affected by the eMudhra CA compromise.

In an empty directory I created a fresh Pipenv by installing a random package:

$ pipenv install pyyaml
$ pipenv --venv
/home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8

This now creates a new pipenv and seeds it with a vulnerable pip version:

$ pipenv run pip3 --version
pip 25.1.1 from /home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8/lib/python3.13/site-packages/pip
(python 3.13)

The compromised certificates are located in the file:

/home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8/lib/python3.13/site-packages/pip/_vendor/certifi/cacert.pem

Namely, certificates with these sha256 fingerprints are still included:

D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4
86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B

I can work around that issue by explicitly installing a newer pip version,
e.g.,

$ pipenv install pip
$ pipenv run pip3 --version
pip 26.2.2 from /home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8/lib/python3.13/site-packages/pip
(python 3.13)

So, the version of pip seeded into a fresh Pipenv should be updated.

Best,
Maximilian