Bundled root stores may include compromised eMudhra certificate
Original title: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra)
Hanno Böck found the affected Comodo AAA Services certificate in Gentoo's texlive curl CA bundle.
Hanno Böck warned on oss-security that the eMudhra certificate compromise can affect any software that ships its own root certificate store. Checking installed .crt files, he found /usr/share/tlpkg/installer/curl/curl-ca-bundle.crt from Gentoo's texlive-core package, which uses an upstream texlive-infra file, and said it contains the affected Comodo AAA Services certificate. The post title also names nmap/ncat; the excerpt does not describe those packages.
Unconfirmed: The excerpt does not confirm nmap or ncat findings or how widely the compromised certificate was misused.
- The note was posted on October 20.
- The identified file is curl-ca-bundle.crt under texlive's installer path.
- Böck attributes the bundle to texlive-infra via Gentoo's texlive-core package.
- The excerpt cuts off before a full list of affected bundles.
Impact: Bundled trust stores may accept a compromised certificate authority
| Product | Affected |
|---|---|
| texlive-infra | — |
| Gentoo texlive-core | — |
- 1.Check bundled .crt files for the affected Comodo AAA Services certificate.
From the original article
Posted by Hanno Böck on Oct 20 Hi, The recent eMudhra certificate compromise means that every software that bundles its own root certificate store is potentially affected. I went through my systems and checked for installed . crt files in /usr: /usr/share/tlpkg/installer/curl/curl-ca-bundle.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.