Backported a patch to address the eMudhra Intermediate CA Compromise disclosed at https://emudhra.we-have-a-problem.com. As this is a certificate authority compromise rather than a software flaw it doesn't have a CVE number, but this should be treated like a CVE fix.
This is a backport rather than a version bump as Debian did a "non-maintainer upload" 20260816+nmu1 instead of a typical new version release. Signed-off-by: Paul Barker <[email protected]> Signed-off-by: Richard Purdie <[email protected]> (cherry picked from commit c5098a7074996258e448bc6cf3d4fb1a708f7a42) Signed-off-by: Yoann Congal <[email protected]> --- ...mSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch | 35 ++++++++++++++++++++++ .../ca-certificates/ca-certificates_20260816.bb | 1 + 2 files changed, 36 insertions(+) diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch new file mode 100644 index 000000000000..9a0258919aa6 --- /dev/null +++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch @@ -0,0 +1,35 @@ +From d5e08f63b1ca6746a51e62cda4df5483c0d3e2ec Mon Sep 17 00:00:00 2001 +From: Paul Barker <[email protected]> +Date: Wed, 21 Oct 2026 07:16:23 +0100 +Subject: [PATCH] Blacklist "emSign ECC Root CA - G3" and "Comodo AAA Services + root" + +[PB: Backported to address the eMudhra Intermediate CA Compromise + disclosed at https://emudhra.we-have-a-problem.com. As this is a + certificate authority compromise rather than a software flaw it + doesn't have a CVE number, but this should be treated like a CVE + fix.] + +Upstream-Status: Backport [https://salsa.debian.org/debian/ca-certificates/-/commit/4a0203e5ce4ce1a064b97387f52ca6a00c97185c] +Signed-off-by: Paul Barker <[email protected]> +--- + mozilla/blacklist.txt | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/mozilla/blacklist.txt b/mozilla/blacklist.txt +index d84ceb919906..ba3635f7af87 100644 +--- a/mozilla/blacklist.txt ++++ b/mozilla/blacklist.txt +@@ -3,4 +3,9 @@ + # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors + "Explicitly Distrust DigiNotar Root CA" + ++# Blacklist "emSign ECC Root CA - G3" (cf. #1151413) ++"emSign ECC Root CA - G3" ++# Blacklist "Comodo AAA Services root" (cf. #1151413) ++"Comodo AAA Services root" ++ + # Expired CAs +-- +2.43.0 + diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb b/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb index c9702d545a1c..be1ffeae4f54 100644 --- a/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb +++ b/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb @@ -19,6 +19,7 @@ SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \ file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \ file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \ file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \ + file://0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch \ " S = "${UNPACKDIR}/ca-certificates" inherit allarch -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248506): https://lists.openembedded.org/g/openembedded-core/message/248506 Mute This Topic: https://lists.openembedded.org/mt/121897993/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
