ca-certificates: Disable compromised CA certificates

Backported a patch to address the eMudhra Intermediate CA Compromise
disclosed at https://emudhra.we-have-a-problem.com. As this is a
certificate authority compromise rather than a software flaw it doesn't
have a CVE number, but this should be treated like a CVE fix.

This is a backport rather than a version bump as Debian did a
"non-maintainer upload" 20260816+nmu1 instead of a typical new version
release.

Signed-off-by: Paul Barker <paul@pbarker.dev>
---
 ...mSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch | 35 ++++++++++++++++++++++
 .../ca-certificates/ca-certificates_20260816.bb    |  1 +
 2 files changed, 36 insertions(+)


---
base-commit: 94fd491210b5269f7242df59db1541379e25754f
change-id: 20261021-ca-certs-dff9f0ace701

Best regards,
--  
Paul Barker

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Paul Barker
> Sent: den 21 oktober 2026 09:00
> To: openembedded-core@lists.openembedded.org
> Cc: Paul Barker <paul@pbarker.dev>
> Subject: [OE-core] [PATCH] ca-certificates: Disable compromised CA certificates
> 
> Backported a patch to address the eMudhra Intermediate CA Compromise
> disclosed at https://emudhra.we-have-a-problem.com. As this is a
> certificate authority compromise rather than a software flaw it doesn't
> have a CVE number, but this should be treated like a CVE fix.
> 
> This is a backport rather than a version bump as Debian did a
> "non-maintainer upload" 20260816+nmu1 instead of a typical new version
> release.
> 
> Signed-off-by: Paul Barker <paul@pbarker.dev>
> ---
>  ...mSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch | 35 ++++++++++++++++++++++
>  .../ca-certificates/ca-certificates_20260816.bb    |  1 +
>  2 files changed, 36 insertions(+)
> 
> diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch
> new file mode 100644
> index 000000000000..9a0258919aa6
> --- /dev/null
> +++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch
> @@ -0,0 +1,35 @@
> +From d5e08f63b1ca6746a51e62cda4df5483c0d3e2ec Mon Sep 17 00:00:00 2001
> +From: Paul Barker <paul@pbarker.dev>
> +Date: Wed, 21 Oct 2026 07:16:23 +0100
> +Subject: [PATCH] Blacklist "emSign ECC Root CA - G3" and "Comodo AAA Services
> + root"
> +
> +[PB: Backported to address the eMudhra Intermediate CA Compromise
> +     disclosed at https://emudhra.we-have-a-problem.com. As this is a
> +     certificate authority compromise rather than a software flaw it
> +     doesn't have a CVE number, but this should be treated like a CVE
> +     fix.]
> +
> +Upstream-Status: Backport [https://salsa.debian.org/debian/ca-certificates/-/commit/4a0203e5ce4ce1a064b97387f52ca6a00c97185c]
> +Signed-off-by: Paul Barker <paul@pbarker.dev>
> +---
> + mozilla/blacklist.txt | 5 +++++
> + 1 file changed, 5 insertions(+)
> +
> +diff --git a/mozilla/blacklist.txt b/mozilla/blacklist.txt
> +index d84ceb919906..ba3635f7af87 100644
> +--- a/mozilla/blacklist.txt
> ++++ b/mozilla/blacklist.txt
> +@@ -3,4 +3,9 @@
> + # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors
> + "Explicitly Distrust DigiNotar Root CA"
> +
> ++# Blacklist "emSign ECC Root CA - G3" (cf. #1151413)
> ++"emSign ECC Root CA - G3"
> ++# Blacklist "Comodo AAA Services root" (cf. #1151413)
> ++"Comodo AAA Services root"
> ++
> + # Expired CAs
> +--
> +2.43.0
> +
> diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb b/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb
> index c9702d545a1c..be1ffeae4f54 100644
> --- a/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb
> +++ b/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb
> @@ -19,6 +19,7 @@ SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
>             file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
>             file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \
>             file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \
> +           file://0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch \
>             "
>  S = "${UNPACKDIR}/ca-certificates"
>  inherit allarch
> 
> ---
> base-commit: 94fd491210b5269f7242df59db1541379e25754f
> change-id: 20261021-ca-certs-dff9f0ace701
> 
> Best regards,
> --
> Paul Barker

There is a related CVE, CVE-2026-111943, for golang.

//Peter

On Wed, Oct 21, 2026 at 9:56 AM Peter Kjellerstedt via
lists.openembedded.org <peter.kjellerstedt=axis.com@lists.openembedded.org>
wrote:

> > -----Original Message-----
> > From: openembedded-core@lists.openembedded.org <
> openembedded-core@lists.openembedded.org> On Behalf Of Paul Barker
> > Sent: den 21 oktober 2026 09:00
> > To: openembedded-core@lists.openembedded.org
> > Cc: Paul Barker <paul@pbarker.dev>
> > Subject: [OE-core] [PATCH] ca-certificates: Disable compromised CA
> certificates
> >
> > Backported a patch to address the eMudhra Intermediate CA Compromise
> > disclosed at https://emudhra.we-have-a-problem.com. As this is a
> > certificate authority compromise rather than a software flaw it doesn't
> > have a CVE number, but this should be treated like a CVE fix.
> >
> > This is a backport rather than a version bump as Debian did a
> > "non-maintainer upload" 20260816+nmu1 instead of a typical new version
> > release.
> >
> > Signed-off-by: Paul Barker <paul@pbarker.dev>
> > ---
> >  ...mSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch | 35
> ++++++++++++++++++++++
> >  .../ca-certificates/ca-certificates_20260816.bb    |  1 +
> >  2 files changed, 36 insertions(+)
> >
> > diff --git
> a/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch
> b/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch
> > new file mode 100644
> > index 000000000000..9a0258919aa6
> > --- /dev/null
> > +++
> b/meta/recipes-support/ca-certificates/ca-certificates/0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch
> > @@ -0,0 +1,35 @@
> > +From d5e08f63b1ca6746a51e62cda4df5483c0d3e2ec Mon Sep 17 00:00:00 2001
> > +From: Paul Barker <paul@pbarker.dev>
> > +Date: Wed, 21 Oct 2026 07:16:23 +0100
> > +Subject: [PATCH] Blacklist "emSign ECC Root CA - G3" and "Comodo AAA
> Services
> > + root"
> > +
> > +[PB: Backported to address the eMudhra Intermediate CA Compromise
> > +     disclosed at https://emudhra.we-have-a-problem.com. As this is a
> > +     certificate authority compromise rather than a software flaw it
> > +     doesn't have a CVE number, but this should be treated like a CVE
> > +     fix.]
> > +
> > +Upstream-Status: Backport [
> https://salsa.debian.org/debian/ca-certificates/-/commit/4a0203e5ce4ce1a064b97387f52ca6a00c97185c
> ]
> > +Signed-off-by: Paul Barker <paul@pbarker.dev>
> > +---
> > + mozilla/blacklist.txt | 5 +++++
> > + 1 file changed, 5 insertions(+)
> > +
> > +diff --git a/mozilla/blacklist.txt b/mozilla/blacklist.txt
> > +index d84ceb919906..ba3635f7af87 100644
> > +--- a/mozilla/blacklist.txt
> > ++++ b/mozilla/blacklist.txt
> > +@@ -3,4 +3,9 @@
> > + # Blacklist explicitly distrusted certificates to explicitly ignore
> them and prevent build errors
> > + "Explicitly Distrust DigiNotar Root CA"
> > +
> > ++# Blacklist "emSign ECC Root CA - G3" (cf. #1151413)
> > ++"emSign ECC Root CA - G3"
> > ++# Blacklist "Comodo AAA Services root" (cf. #1151413)
> > ++"Comodo AAA Services root"
> > ++
> > + # Expired CAs
> > +--
> > +2.43.0
> > +
> > diff --git a/meta/recipes-support/ca-certificates/
> ca-certificates_20260816.bb b/meta/recipes-support/ca-certificates/
> ca-certificates_20260816.bb
> > index c9702d545a1c..be1ffeae4f54 100644
> > --- a/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb
> > +++ b/meta/recipes-support/ca-certificates/ca-certificates_20260816.bb
> > @@ -19,6 +19,7 @@ SRC_URI =
> "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
> >
>  file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
> >
>  file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \
> >
>  file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \
> > +
>  file://0001-Blacklist-emSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch \
> >             "
> >  S = "${UNPACKDIR}/ca-certificates"
> >  inherit allarch
> >
> > ---
> > base-commit: 94fd491210b5269f7242df59db1541379e25754f
> > change-id: 20261021-ca-certs-dff9f0ace701
> >
> > Best regards,
> > --
> > Paul Barker
>
> There is a related CVE, CVE-2026-111943, for golang.
>

Peter Marko already sent it yesterday
https://lists.openembedded.org/g/openembedded-core/message/248308

Jose


>
> //Peter
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#248375):
> https://lists.openembedded.org/g/openembedded-core/message/248375
> Mute This Topic: https://lists.openembedded.org/mt/121863200/10043485
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> jose.quaresma@oss.qualcomm.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>