uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

Uv verifies TLS connections using a vendored 'webpki-root-certs' bundle. Versions prior to 0.13.4 include the 'emSign ECC Root CA - G3' root certificate. Eight intermediate CA certificates under this root, issued by eMudhra, have compromised private keys and have been revoked by the CA. An attacker possessing one of these compromised keys can issue certificates trusted by uv for any hostname, facilitating MITM attacks. Uv 0.13.4 updates the root certificate bundle to remove this compromised root, following the update in 'webpki-root-certs' version 1.0.10.

An attacker with one of the compromised intermediate CA private keys can create certificates trusted by uv for any hostname. This undermines TLS security by enabling man-in-the-middle attacks, potentially exposing sensitive data or allowing impersonation of legitimate services.

Upgrade uv to version 0.13.4 or later, which removes the compromised 'emSign ECC Root CA - G3' root from the bundled CA store. This update aligns with 'webpki-root-certs' version 1.0.10 and mitigates the vulnerability. Since a patch is available, applying this official fix is the recommended remediation.