Your message dated Thu, 22 Oct 2026 18:47:05 +0000
with message-id <[email protected]>
and subject line Bug#1151413: fixed in ca-certificates 20250419+deb13u1
has caused the Debian Bug report #1151413,
regarding ca-certificates: remove emSign ECC Root CA - G3 (eMudhra intermediate
CA key compromise)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151413: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151413
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ca-certificates
Version: 20250419
Severity: grave
Tags: security
X-Debbugs-Cc: [email protected]
The private keys of eight eMudhra intermediate CAs have been
compromised. These were revoked for cACompromise on 18-19 Oct 2026.
Six of them are TLS intermediates under "emSign Root TLS CA - G3",
which chains to "emSign ECC Root CA - G3" in our bundle. Some also
chain via Sectigo cross-signs to "AAA Certificate Services" (shipped
as "Comodo AAA Services root").
Anyone holding these keys can issue certificates for arbitrary
domains. Browsers block the intermediates via OneCRL/CRLSets, but
OpenSSL, GnuTLS, rustls-native-certs and other users of
/etc/ssl/certs do not check revocation. They rely only on this
package, so they remain exposed.
Mozilla removed emSign ECC Root CA - G3 from NSS on 20 Oct 2026
(NSS 3.131.1). Ubuntu, certifi, webpki-roots, Go and Homebrew have
already shipped fixes.
Requested:
- Remove/blacklist "emSign ECC Root CA - G3"
(SPKI SHA-256
8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782)
in unstable, and in trixie and bookworm via the security archive.
- Remove "Comodo AAA Services root" in trixie and bookworm (it was
already removed in 20260223 in testing/unstable).
References:
https://emudhra.we-have-a-problem.com/
https://bugzilla.mozilla.org/show_bug.cgi?id=2083709
https://github.com/golang/go/issues/82345
OpenPGP_signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: ca-certificates
Source-Version: 20250419+deb13u1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ca-certificates, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated ca-certificates
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Oct 2026 16:57:59 +0200
Source: ca-certificates
Architecture: source
Version: 20250419+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Julien Cristau <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1151413
Changes:
ca-certificates (20250419+deb13u1) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Blacklist "emSign ECC Root CA - G3" and "Comodo AAA Services root"
(Closes: #1151413)
Checksums-Sha1:
44effdeab045b9b4749c3e21df2308a2ef7587ee 1924
ca-certificates_20250419+deb13u1.dsc
9cb42f4ec253537eabfaafcd81dfdb7264810b0f 277284
ca-certificates_20250419+deb13u1.tar.xz
bd56dbad8d9b6068b70ff3dae812931cce09efe0 5318
ca-certificates_20250419+deb13u1_source.buildinfo
Checksums-Sha256:
347487e99c0b9f09150c8d78ad03e3552545c3904d5e0d7f731ef2ef79d484d4 1924
ca-certificates_20250419+deb13u1.dsc
1b2e3d0b90cfc62ac8033d64e18ea4649fbb2a01c937c9ac9d36e762da6b9446 277284
ca-certificates_20250419+deb13u1.tar.xz
f416a0ba3c982a232c11838094c75accf84bf1caf8964838e308e5c9b9149012 5318
ca-certificates_20250419+deb13u1_source.buildinfo
Files:
0495ed0ad8023cb600628685fcaa6e9d 1924 misc optional
ca-certificates_20250419+deb13u1.dsc
4c76649be2852bbb42ab4940544e2e58 277284 misc optional
ca-certificates_20250419+deb13u1.tar.xz
1627a0e888d02e7fa8dba3bf5db99ed7 5318 misc optional
ca-certificates_20250419+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrXvL1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EIBgP/0MVfpv4OK5+yV/4iVMNZqMrS/e7KxZS
tGI9FTZrnxFVUKiiBRyTbK32zeDBi3OsoUAJzHoR9Va8xAJysE9bOp2pODCmBlBq
3zBQmwlH3pChUvz4styaEfM9vcHvBHe3orBukMW+8RbtISoOOAp/IcHyzYyHAzS/
5zYJJKZomYsJeDWFrsoi51EEn5wIVW1FDGbhMkqQA5Qj2JFW+zaBmST2gHVrvBSw
C+e9tqtxOxJMexcAoFHtwol0HE+3eoHrsI6SoFDEkWDaKZE0s8hY0MV2Iufh/E0Y
HOa8JDAVA9O+uyXw0qHObGWsMWoEFA+Zz4vUh81Is9AUzvJsVv7UCnILzemDU0oY
hDdg/t8cIvXmUjskigdKXm8STmE82yhuGGhoszBDBlX6sz9VU9PfOep721G3CUFK
0K71jNxmPPg+rN4NjQFUNaLE4T16qT9k4eCP4zL5PrzwUHr5DYk3Pg3qBhqKve4i
mls6IUyBfPjGs/ZltgOMIb4Lcq9VzKCu3BNkfujRasyA8qAjvps48zlOY51pIDe1
icuxcBDkElz4YLdvSvpc7hjRuzb8syzr9dr4icDTtUIUrfW+cUkfEqHPhMyRAH0E
Fgm2PbGrxiEyE/FmUuluyqYeS1xZpeH3EwQj06XvBJcuY3a8oRakAW/AkHnSkdB8
/jBmgx7DhL+w
=ia+T
-----END PGP SIGNATURE-----
pgpBnmcBERyN1.pgp
Description: PGP signature
--- End Message ---
