Summary
[2025.2.80_v9.0.304-71.0.2]
- eMudhra: add 'emSign ECC Root CA - G3' and 'Comodo AAA Services root' to blocklist
[2025.2.80_v9.0.304-71.0.1]
- Resolve ELBA-2025-22492 [Orabug: 38712242]
- Update to CKBI 2.80_v9.0.304 from NSS 3.114
- Adding:
- # Certificate 'TWCA CYBER Root CA'
- # Certificate 'TWCA Global Root CA G2'
- # Certificate 'SecureSign Root CA12'
- # Certificate 'SecureSign Root CA14'
- # Certificate 'SecureSign Root CA15'
- # Certificate 'D-TRUST BR Root CA 2 2023'
- # Certificate 'TrustAsia SMIME ECC Root CA'
- # Certificate 'TrustAsia SMIME RSA Root CA'
- # Certificate 'TrustAsia TLS ECC Root CA'
- # Certificate 'TrustAsia TLS RSA Root CA'
- # Certificate 'D-TRUST EV Root CA 2 2023'
- # Certificate 'SwissSign RSA SMIME Root CA 2022 - 1'
- # Certificate 'SwissSign RSA TLS Root CA 2022 - 1'
- # Certificate 'Sectigo Public Code Signing Root R46'
- # Certificate 'Sectigo Public Code Signing Root E46'
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ca-certificates | 0:2025.2.80_v9.0.304-71.0.2.el7_9 |
Vulnerabilities 4
-
Critical 9.1CVE-2026-114820 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.8CVE-2026-111943 Public exploit
Distrust compromised intermediate certificates in crypto/x509
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…
-
Medium 6.8
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…
-
Medium 5.4
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised c…