Skip to content
OpenAdvisories

Package · GitHub Actions

pypa/gh-action-pypi-publish

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical —
    GHSA-5xjx-3w67-w9x9

    pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

    ### Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them…

    pypa/gh-action-pypi-publish GitHub Actions