Bug 2556046 (CVE-2026-114406)
| Summary: | CVE-2026-114406 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | akhatavk, anjoseph, anthomas, aos-team-art-private, asdas, asegurap, bsquizza, cmitchel, crizzo, dfreiber, dhanak, dkeler, doconnor, dpaolell, drosa, drow, dsimansk, dymurray, ehelms, elicohen, eric.eisenhart, gbenhaim, ggainey, gparvin, gtanzill, ibolton, jbalunas, jburrell, jbuscemi, jcantril, jdelft, jmatthew, jmontleo, jpasqual, jprabhak, jupierce, juwatts, kaycoth, kbempah, kingland, lgamliel, lgarciaa, mbiarnes, mdellweg, me, mhulan, mnovotny, mwringe, niyer, nmoumoul, osousa, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sausingh, sbratsla, security-response-team, sghai, sidsharm, slucidi, smallamp, solenoci, sseago, suppawar, thason, tmalecek, tsze, twaugh, vkumar, vlaad, vvoronko, watson-tool-maintainers, wtam, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-20 09:04:20 UTC
NSS version 3.131.1 was released: https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs/m/jJiNOdcEAQAJ removing the following root certificates: - emSign Root CA - C1 - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 Public now via: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ python-certifi 2026.10.18 also removed emSign root certificates: https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2 Related issues and PRs: https://github.com/certifi/python-certifi/pull/437 https://github.com/certifi/python-certifi/issues/439 Three of the removed certificates were subsequently re-introduced in version 2026.10.19: https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 Web site for this problem, with test hosts using affected certificates, and status info for various vendors: https://emudhra.we-have-a-problem.com/ Mozilla dev-security-policy post with more details from both Mozilla and Chrome: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ Mozilla bug report with technical details of the problem: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:88455 https://access.redhat.com/errata/RHSA-2026:88455 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:88459 https://access.redhat.com/errata/RHSA-2026:88459 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:88550 https://access.redhat.com/errata/RHSA-2026:88550 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:88564 https://access.redhat.com/errata/RHSA-2026:88564 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:88560 https://access.redhat.com/errata/RHSA-2026:88560 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:88562 https://access.redhat.com/errata/RHSA-2026:88562 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:88563 https://access.redhat.com/errata/RHSA-2026:88563 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:88662 https://access.redhat.com/errata/RHSA-2026:88662 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Via RHSA-2026:88669 https://access.redhat.com/errata/RHSA-2026:88669 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:88668 https://access.redhat.com/errata/RHSA-2026:88668 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:88779 https://access.redhat.com/errata/RHSA-2026:88779 |