AMS Security Advisory: eMudhra/emSign Certificate Incident
This post is live-updated
The eMudhra/emSign certificate security incident affects many software products, not just AMS. We recommend discussing it with your IT team.
What is affected in AMS
In AMS, the issue concerns downloading and installing optional packages.
Until the issue is fixed, do not
- download/install packages from the AMS package manager (SCM -> Packages,
$AMSBIN/amspackages). - download/install packages with
$AMSBIN/amspython -m pip - download/install packages with
$AMSBIN/uv
What is not affected in AMS
The issue does not affect
- calculations with AMS, ADF, COSMO-RS, etc.
- included Python tools like PLAMS and ParAMS
What SCM is doing
We are working on releasing a patched version, and will send an e-mail to all users when it is ready to be downloaded.
Details about the issue
Overview
This incident affects software’s ability to check that an internet connection is to the intended server. If an attacker can intercept a download connection, the affected certificates could allow them to impersonate the intended server and supply an altered download.
Python package tools
One aspect of the incident affects uv and pip, two tools for downloading and managing Python packages. AMS includes affected versions of these tools.
These tools include their own certificate information, so updating your operating system alone may not resolve the issue. Existing Python environments may also need updating separately.
Impact on AMS
AMS does not use pip or uv to run calculations. You can continue to start and run calculations, including those using packages and models already installed through AMSPackages. There is no need to stop running jobs or reinstall those packages simply to continue calculations.
The issue is relevant when AMS or its supplied tools connect to an online service, including:
- Downloading and installing environments through AMSPackages.
- Installing Python packages with amspython -m pip install.
- Creating or updating Python environments using the uv supplied with AMS.
Using an already installed package for a calculation is different from installing or updating that package: it is the download operation that is relevant to this issue. Existing Python environments can retain their own affected certificate information, so they may need updating before you use them for further downloads. Some third-party Python libraries supplied with AMS can also download models or other data over HTTPS. AMS does not use these libraries’ download features directly, so this additional concern is limited to cases where you use those features in your own Python scripts.
