ActiveState Release of Python 2.7.18.15

Python 2.7.18.15, ActiveState's Python 2.7 fork

This is a security release on top of 2.7.18.14. It responds to the eMudhra/emSign CA key compromise and refreshes the pip and setuptools that ensurepip bundles. It was merged in #91 and is the same code as rc2.

Security

• ssl distrusts the compromised eMudhra intermediate CA keys (CVE-2026-115557, pythongh-160040, backported).
  • Certificate chains containing any of the 8 compromised keys now fail verification with "certificate verify failed".
  • The match is on the SHA-256 of each certificate's SubjectPublicKeyInfo, so cross-signed copies that reuse a key are caught too.
  • The check applies whenever verify_mode is CERT_OPTIONAL or CERT_REQUIRED, including create_default_context(), urllib2 and httplib.
• ensurepip bundles pip 20.3.4.post4 and setuptools 44.1.1.post3, replacing pip 19.2.3 and setuptools 41.2.0.
  • pip 20.3.4.post4 vendors certifi 2026.10.23.post1, which removes the emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3 roots. emSign Root CA - G1 is the only emSign root left. pip's TLS goes through ssl, so the denylist above also applies to it.
  • setuptools 44.1.1.post3 includes the fixes for CVE-2022-40897, CVE-2024-6345, CVE-2025-47273 and CVE-2026-59890.

Testing

• Linux x86_64, against the production OpenSSL 1.1.1w: compared with 2.7.18.14, the full test suite shows no regressions.
• ensurepip: after make altinstall, ensurepip installs pip 20.3.4.post4 and setuptools 44.1.1.post3, and pip download from PyPI works.
• Windows x64: not tested as part of this release work. The release candidates were published for Windows testing on the legacy platform.